[freetype2] master 8ea854b: [truetype] Mask numeric overflows.

[Armin]

branch: master
commit 8ea854bfe92443706d55656072f891ec8f2cb3c2
Author: Armin Hasitzka <address@hidden>
Commit: Armin Hasitzka <address@hidden>

    [truetype] Mask numeric overflows.
    
    * src/truetype/ttinterp.c (Move_CVT, Move_CVT_Stretched, Ins_MIRP):
    Mask numeric overflows.
    
    Reported as
    
      https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11681
      https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11734
---
 ChangeLog               | 12 ++++++++++++
 src/truetype/ttinterp.c |  7 ++++---
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index cb17e77..40564a3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,17 @@
 2019-02-21  Armin Hasitzka  <address@hidden>
 
+       [truetype] Mask numeric overflows.
+
+       * src/truetype/ttinterp.c (Move_CVT, Move_CVT_Stretched, Ins_MIRP):
+       Mask numeric overflows.
+
+       Reported as
+
+         https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11681
+         https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11734
+
+2019-02-21  Armin Hasitzka  <address@hidden>
+
        [psaux] Mask numeric overflow.
 
        * src/psaux/cffdecode.c (cff_decoder_parse_charstrings): Mask numeric
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index fc8615b..90676b8 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -1564,7 +1564,7 @@
             FT_ULong        idx,
             FT_F26Dot6      value )
   {
-    exc->cvt[idx] += value;
+    exc->cvt[idx] = ADD_LONG( exc->cvt[idx], value );
   }
 
 
@@ -1573,7 +1573,8 @@
                       FT_ULong        idx,
                       FT_F26Dot6      value )
   {
-    exc->cvt[idx] += FT_DivFix( value, Current_Ratio( exc ) );
+    exc->cvt[idx] = ADD_LONG( exc->cvt[idx],
+                              FT_DivFix( value, Current_Ratio( exc ) );
   }
 
 
@@ -6311,7 +6312,7 @@
     if ( exc->GS.auto_flip )
     {
       if ( ( org_dist ^ cvt_dist ) < 0 )
-        cvt_dist = -cvt_dist;
+        cvt_dist = NEG_LONG( cvt_dist );
     }
 
 #ifdef TT_SUPPORT_SUBPIXEL_HINTING_INFINALITY