lib/freetype
1
0
Fork 0
mirror of https://github.com/freetype/freetype.git synced 2026-10-23 11:08:54 +03:00
Code Activity

[truetype] Avoid overflow in VARC axis values.

Browse Source 
Reported as

  https://issues.oss-fuzz.com/issues/570754474

* src/truetype/ttvarc.c (tt_varc_parse_component): Use `MUL_INT32` for
  converting 32-bit packed axis values from `F2DOT14` to `F16DOT16`.

  (tt_face_load_varc_glyph): Use `NEG_LONG` when rounding negative axis
  values, since the conversion can wrap to `INT32_MIN` and negating that
  value overflows on platforms with 32-bit longs.

Assisted-by: OpenAI Codex
This commit is contained in:
Behdad Esfahbod
2026-10-08 11:58:47 -06:00
committed by Werner Lemberg
parent 79d80cadfc
commit e2526d30e6
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/truetype/ttvarc.c
View File

@@ -820,7 +820,7 @@
(FT_UInt32)(*p)[3] );
component->axis_values[i++] = (FT_Fixed)( val * 4 );
component->axis_values[i++] = (FT_Fixed)MUL_INT32( val, 4 );
*p += 4;
}
}
@@ -3460,7 +3460,7 @@
if ( v >= 0 )
v = ( v + 2 ) & ~(FT_Fixed)3;
else
v = -( ( -v + 2 ) & ~(FT_Fixed)3 );
v = NEG_LONG( ( NEG_LONG( v ) + 2 ) & ~(FT_Fixed)3 );
new_coords[axis_idx] = v;
FT_TRACE7(( " axis %u: %.5f\n",