commit 079a22da037835daf5be2bd9eccf7bc1eaa2e783
author Werner Lemberg <wl@gnu.org> Tue Apr 19 09:28:21 2022 +0200
committer Werner Lemberg <wl@gnu.org> Tue Apr 19 09:34:10 2022 +0200
tree 062124442286ef51d3f7a8e3697822240e260603
parent 978eefee5401abee6bf702c6bcde9afb47893145

* src/truetype/ttgload.c (TT_Process_Simple_Glyph): Integer overflow.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46792

src/truetype/ttgload.c

diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index 0ecde22..2ca63d6 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -1104,8 +1104,8 @@
 
           for ( ; vec < limit; vec++, u++ )
           {
-            vec->x = ( FT_MulFix( u->x, x_scale ) + 32 ) >> 6;
-            vec->y = ( FT_MulFix( u->y, y_scale ) + 32 ) >> 6;
+            vec->x = ADD_LONG( FT_MulFix( u->x, x_scale ), 32 ) >> 6;
+            vec->y = ADD_LONG( FT_MulFix( u->y, y_scale ), 32 ) >> 6;
           }
         }
         else