tree 59010223d67b313f640334ad28f4b2f113f62eab
parent 2240e21cf5073e69442ae42519f5486014bd7d5d
author Ben Wagner <bungeman@chromium.org> 1715120398 -0400
committer Werner Lemberg <wl@gnu.org> 1715137276 +0200

[colr] Avoid overflow in range checks

In 32 bit builds `FT_ULong` is 32 bits and can silently overflow when a
large number is read into one and then it is summed or multiplied with
another number.  Checks for range overflow must be written so that they
themselves do not overflow.  Also ensure that the table_size is always the
first part of the range check and consistently use `<` or `<=`.

* src/sfnt/ttcolr.c (tt_face_load_colr): Avoid overflow.
(find_base_glyph_v1_record): Remove old work-around.

Bug: https://issues.chromium.org/issues/41495455
Bug: https://issues.chromium.org/issues/40945818