[freetype2] master 7b855ed: * src/pshinter/pshrec.c (t2_hints_stems): Mask numeric overflow.

[Armin]

branch: master
commit 7b855ed9cf8c48841e72369ea3ebcbf8486e5e06
Author: Armin Hasitzka <address@hidden>
Commit: Armin Hasitzka <address@hidden>

    * src/pshinter/pshrec.c (t2_hints_stems): Mask numeric overflow.
    
    Reported as
    
      https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10215
---
 ChangeLog             | 8 ++++++++
 src/pshinter/pshrec.c | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 97a11b4..5f2fb97 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2018-09-10  Armin Hasitzka  <address@hidden>
+
+       * src/pshinter/pshrec.c (t2_hints_stems): Mask numeric overflow.
+
+       Reported as
+
+         https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10215
+
 2018-09-09  Ben Wagner  <address@hidden>
 
        * builds/freetype.mk (refdoc-venv): Ensure python version (#54631).
diff --git a/src/pshinter/pshrec.c b/src/pshinter/pshrec.c
index 5cece05..401ab19 100644
--- a/src/pshinter/pshrec.c
+++ b/src/pshinter/pshrec.c
@@ -1187,7 +1187,7 @@
       /* compute integer stem positions in font units */
       for ( n = 0; n < count * 2; n++ )
       {
-        y       += coords[n];
+        y        = ADD_LONG( y, coords[n] );
         stems[n] = FIXED_TO_INT( y );
       }