[freetype2] master 9adc3b3: * src/psaux/cffdecode.c (cff_operator_seac): Fix numeric overflow.

[Werner LEMBERG]

branch: master
commit 9adc3b35f1a6909c1785c42ae7b8cf369634b225
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    * src/psaux/cffdecode.c (cff_operator_seac): Fix numeric overflow.
    
    Reported as
    
      https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16470
---
 ChangeLog             | 8 ++++++++
 src/psaux/cffdecode.c | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index fdd4e2b..b6c3b32 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2019-08-26  Werner Lemberg  <address@hidden>
 
+       * src/psaux/cffdecode.c (cff_operator_seac): Fix numeric overflow.
+
+       Reported as
+
+         https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16470
+
+2019-08-26  Werner Lemberg  <address@hidden>
+
        [type1] Fix `FT_Get_Var_Axis_Flags' (#56804).
 
        * src/type1/t1load.c (T1_Get_MM_Var): Allocate space for axis flags.
diff --git a/src/psaux/cffdecode.c b/src/psaux/cffdecode.c
index 17cccf8..06c6af4 100644
--- a/src/psaux/cffdecode.c
+++ b/src/psaux/cffdecode.c
@@ -330,7 +330,7 @@
     builder->left_bearing.x = 0;
     builder->left_bearing.y = 0;
 
-    builder->pos_x = adx - asb;
+    builder->pos_x = SUB_LONG( adx, asb );
     builder->pos_y = ady;
 
     /* Now load `achar' on top of the base outline. */