commit 7b855ed9cf8c48841e72369ea3ebcbf8486e5e06
author Armin Hasitzka <prince.cherusker@gmail.com> Mon Sep 10 23:41:04 2018 +0100
committer Armin Hasitzka <prince.cherusker@gmail.com> Mon Sep 10 23:41:04 2018 +0100
tree 571f43d0e6f0f0a92410fb088db35c8f95f81fc5
parent fea435fbf855e9ac2cd3ced80175d64f1bace22c

* src/pshinter/pshrec.c (t2_hints_stems): Mask numeric overflow.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10215

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 97a11b4..5f2fb97 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2018-09-10  Armin Hasitzka  <prince.cherusker@gmail.com>
+
+	* src/pshinter/pshrec.c (t2_hints_stems): Mask numeric overflow.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10215
+
 2018-09-09  Ben Wagner  <bungeman@google.com>
 
 	* builds/freetype.mk (refdoc-venv): Ensure python version (#54631).

src/pshinter/pshrec.c

diff --git a/src/pshinter/pshrec.c b/src/pshinter/pshrec.c
index 5cece05..401ab19 100644
--- a/src/pshinter/pshrec.c
+++ b/src/pshinter/pshrec.c
@@ -1187,7 +1187,7 @@
       /* compute integer stem positions in font units */
       for ( n = 0; n < count * 2; n++ )
       {
-        y       += coords[n];
+        y        = ADD_LONG( y, coords[n] );
         stems[n] = FIXED_TO_INT( y );
       }