* src/psaux/psintrp.c (cf2_doStems): Fix integer overflow.

Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3510
7 years ago · ec7d2e5f68
parent 97cd12657d
commit ec7d2e5f68
2 changed files with 10 additions and 2 deletions
--- a/8
+++ b/8
@ -1,3 +1,11 @@
+2017-09-28  Werner Lemberg  <wl@gnu.org>
+
+	* src/psaux/psintrp.c (cf2_doStems): Fix integer overflow.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3510
+
 2017-09-28  Ewald Hew  <ewaldhew@gmail.com>

 	* src/cid/cidgload.c (cid_slot_load_glyph): Fix memory leak.
--- a/src/psaux/psintrp.c
+++ b/src/psaux/psintrp.c
@ -297,8 +297,8 @@
                 " No width. Use hsbw/sbw as first op\n" ));
    }
    if ( !font->isT1 && hasWidthArg && !*haveWidth )
-      *width = cf2_stack_getReal( opStack, 0 ) +
-                 cf2_getNominalWidthX( font->decoder );
+      *width = ADD_INT32( cf2_stack_getReal( opStack, 0 ),
+                          cf2_getNominalWidthX( font->decoder ) );

    if ( font->decoder->width_only )
      goto exit;