[freetype2] master bd9400b: [truetype] Integer overflow issues.

[Werner LEMBERG]

branch: master
commit bd9400bd464f6cd7c74f52ece1c1065fe2a87aab
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    [truetype] Integer overflow issues.
    
    Reported as
    
      https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7453
    
    * src/truetype/ttinterp.c (Round_Super, Round_Super_45): Use
    ADD_LONG and SUB_LONG.
---
 ChangeLog               | 11 +++++++++++
 src/truetype/ttinterp.c |  8 ++++----
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 57540b4..01ed40e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2018-04-09  Werner Lemberg  <address@hidden>
+
+       [truetype] Integer overflow issues.
+
+       Reported as
+
+         https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7453
+
+       * src/truetype/ttinterp.c (Round_Super, Round_Super_45): Use
+       ADD_LONG and SUB_LONG.
+
 2018-04-06  Alexei Podtelezhnikov  <address@hidden>
 
        [windows, wince] Clean up legacy project files.
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index 240dae9..6a5b823 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -2165,7 +2165,7 @@
       val = ADD_LONG( distance,
                       exc->threshold - exc->phase + compensation ) &
               -exc->period;
-      val += exc->phase;
+      val = ADD_LONG( val, exc->phase );
       if ( val < 0 )
         val = exc->phase;
     }
@@ -2174,7 +2174,7 @@
       val = NEG_LONG( SUB_LONG( exc->threshold - exc->phase + compensation,
                                 distance ) &
                         -exc->period );
-      val -= exc->phase;
+      val = SUB_LONG( val, exc->phase );
       if ( val > 0 )
         val = -exc->phase;
     }
@@ -2216,7 +2216,7 @@
       val = ( ADD_LONG( distance,
                         exc->threshold - exc->phase + compensation ) /
                 exc->period ) * exc->period;
-      val += exc->phase;
+      val = ADD_LONG( val, exc->phase );
       if ( val < 0 )
         val = exc->phase;
     }
@@ -2225,7 +2225,7 @@
       val = NEG_LONG( ( SUB_LONG( exc->threshold - exc->phase + compensation,
                                   distance ) /
                           exc->period ) * exc->period );
-      val -= exc->phase;
+      val = SUB_LONG( val, exc->phase );
       if ( val > 0 )
         val = -exc->phase;
     }