[truetype] Integer overflow (#52082).

* src/truetype/ttinterp.c (Ins_MDRP): Avoid FT_ABS.
7 years ago · 6d04bd991b
parent 1ad07c1c79
commit 6d04bd991b
2 changed files with 9 additions and 2 deletions
--- a/6
+++ b/6
@ -1,3 +1,9 @@
+2017-09-21  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Integer overflow (#52082).
+
+	* src/truetype/ttinterp.c (Ins_MDRP): Avoid FT_ABS.
+
 2017-09-21  Werner Lemberg  <wl@gnu.org>

 	[sfnt] Fix postscript name for default instance of variation fonts.
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@ -6078,8 +6078,9 @@

    /* single width cut-in test */

-    if ( FT_ABS( org_dist - exc->GS.single_width_value ) <
-         exc->GS.single_width_cutin )
+    /* |org_dist - single_width_value| < single_width_cutin */
+    if ( org_dist < exc->GS.single_width_value + exc->GS.single_width_cutin ||
+         org_dist > exc->GS.single_width_value - exc->GS.single_width_cutin )
    {
      if ( org_dist >= 0 )
        org_dist = exc->GS.single_width_value;