[freetype2] master 720ae67: * src/truetype/ttgload.c (compute_glyph_metrics): Fix overflow.

[Werner LEMBERG]

branch: master
commit 720ae67f35701819f6bf3fd9337dc89079a4ed27
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    * src/truetype/ttgload.c (compute_glyph_metrics): Fix overflow.
    
    Reported as
    
      https://bugs.chromium.org/p/chromium/issues/detail?id=777151
---
 ChangeLog              | 8 ++++++++
 src/truetype/ttgload.c | 6 +++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index a573e4a..7f0793d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2018-08-05  Werner Lemberg  <address@hidden>
+
+       * src/truetype/ttgload.c (compute_glyph_metrics): Fix overflow.
+
+       Reported as
+
+         https://bugs.chromium.org/p/chromium/issues/detail?id=777151
+
 2018-08-04  Werner Lemberg  <address@hidden>
 
        * src/truetype/ttinterp.c (opcode_name): Fix typos.
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index f0f6a06..9e98f11 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -2284,13 +2284,13 @@
       /* XXX: for now, we have no better algorithm for the lsb, but it */
       /*      should work fine.                                        */
       /*                                                               */
-      glyph->metrics.vertBearingX = glyph->metrics.horiBearingX -
-                                      glyph->metrics.horiAdvance / 2;
+      glyph->metrics.vertBearingX = SUB_LONG( glyph->metrics.horiBearingX,
+                                              glyph->metrics.horiAdvance / 2 );
       glyph->metrics.vertBearingY = top;
       glyph->metrics.vertAdvance  = advance;
     }
 
-    return 0;
+    return FT_Err_Ok;
   }