From ba62f9d8f5f85c6dda93b481271de37fb1f09e77 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Mon, 29 Oct 2018 21:11:36 +0100
Subject: [PATCH] [cff] Fix numeric overflow.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10988

* src/cff/cffparse.c (cff_parser_run)
[CFF_CONFIG_OPTION_OLD_ENGINE]: Use `NEG_LONG'.
---
 ChangeLog          | 11 +++++++++++
 src/cff/cffparse.c |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 651f26e83..7854293d1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2018-10-29  Werner Lemberg  <wl@gnu.org>
+
+	[cff] Fix numeric overflow.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10988
+
+	* src/cff/cffparse.c (cff_parser_run)
+	[CFF_CONFIG_OPTION_OLD_ENGINE]: Use `NEG_LONG'.
+
 2018-10-27  Alexei Podtelezhnikov  <apodtele@gmail.com>
 
 	[sfnt] Make `head' timestamps unsigned.
diff --git a/src/cff/cffparse.c b/src/cff/cffparse.c
index e152c9381..b8b781817 100644
--- a/src/cff/cffparse.c
+++ b/src/cff/cffparse.c
@@ -1259,7 +1259,7 @@
 
           if ( *stack < 0 )
           {
-            num = (FT_ULong)-*stack;
+            num = (FT_ULong)NEG_LONG( *stack );
             neg = 1;
           }
           else