commit dfc9a049ded53e2ca5c9b935f912a476d6f676ed
author Werner Lemberg <wl@gnu.org> Thu Dec 05 08:44:30 2019 +0100
committer Werner Lemberg <wl@gnu.org> Thu Dec 05 08:44:30 2019 +0100
tree 401608d7f75a17d5fdbe66e3502b5bf79c43f99c
parent 551bd3a90e352fa3a66ee7644c07440939c03d81

* src/truetype/ttinterp.c (TT_RunIns): Use `FT_OFFSET'.

Reported as

  https://bugs.chromium.org/p/chromium/issues/detail?id=1030614

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 1660afa..0506b2a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2019-12-05  Werner Lemberg  <wl@gnu.org>
+
+	* src/truetype/ttinterp.c (TT_RunIns): Use `FT_OFFSET'.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/chromium/issues/detail?id=1030614
+
 2019-12-03  Werner Lemberg  <wl@gnu.org>
 
 	More nullptr offset UBSan warnings (#57331, #57347).

src/truetype/ttinterp.c

diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index 1357890..cedc4a5 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -8567,7 +8567,7 @@
         case FT_ERR( Invalid_Opcode ):
           {
             TT_DefRecord*  def   = exc->IDefs;
-            TT_DefRecord*  limit = def + exc->numIDefs;
+            TT_DefRecord*  limit = FT_OFFSET( def, exc->numIDefs );
 
 
             for ( ; def < limit; def++ )