Signed 24-bit values need sign expansion into 32 bits. Only PFR driver, only in bitmap strikes, and
only conditionally uses the signed 24-bit values to specify the bitmap positioning and advance.
Therefore this bug could never be captured.
diff --git a/include/freetype/internal/ftstream.h b/include/freetype/internal/ftstream.h
index 72dd585..187eaa6 100644
--- a/include/freetype/internal/ftstream.h
+++ b/include/freetype/internal/ftstream.h
@@ -196,9 +196,9 @@
FT_BYTE_U32( p, 2, 8 ) | \
FT_BYTE_U32( p, 3, 0 ) )
-#define FT_PEEK_OFF3( p ) FT_INT32( FT_BYTE_U32( p, 0, 16 ) | \
- FT_BYTE_U32( p, 1, 8 ) | \
- FT_BYTE_U32( p, 2, 0 ) )
+#define FT_PEEK_OFF3( p ) ( FT_INT32( FT_BYTE_U32( p, 0, 24 ) | \
+ FT_BYTE_U32( p, 1, 16 ) | \
+ FT_BYTE_U32( p, 2, 8 ) ) >> 8 )
#define FT_PEEK_UOFF3( p ) FT_UINT32( FT_BYTE_U32( p, 0, 16 ) | \
FT_BYTE_U32( p, 1, 8 ) | \
@@ -220,9 +220,9 @@
FT_BYTE_U32( p, 1, 8 ) | \
FT_BYTE_U32( p, 0, 0 ) )
-#define FT_PEEK_OFF3_LE( p ) FT_INT32( FT_BYTE_U32( p, 2, 16 ) | \
- FT_BYTE_U32( p, 1, 8 ) | \
- FT_BYTE_U32( p, 0, 0 ) )
+#define FT_PEEK_OFF3_LE( p ) ( FT_INT32( FT_BYTE_U32( p, 2, 24 ) | \
+ FT_BYTE_U32( p, 1, 16 ) | \
+ FT_BYTE_U32( p, 0, 8 ) ) >> 8 )
#define FT_PEEK_UOFF3_LE( p ) FT_UINT32( FT_BYTE_U32( p, 2, 16 ) | \
FT_BYTE_U32( p, 1, 8 ) | \
