From 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Sat, 19 Mar 2022 06:40:17 +0100 Subject: [PATCH] * src/base/ftobjs.c (ft_open_face_internal): Properly guard `face_index`. We must ensure that the cast to `FT_Int` doesn't change the sign. Fixes #1139. CVE: CVE-2022-27405 Upstream-Status: Backport [https://gitlab.freedesktop.org/freetype/freetype/-/commit/22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5] Comment: No Change in any hunk Signed-off-by: Ranjitsinh Rathod --- src/base/ftobjs.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c index 2c0f0e6c9..10952a6c6 100644 --- a/src/base/ftobjs.c +++ b/src/base/ftobjs.c @@ -2527,6 +2527,15 @@ #endif + /* only use lower 31 bits together with sign bit */ + if ( face_index > 0 ) + face_index &= 0x7FFFFFFFL; + else + { + face_index &= 0x7FFFFFFFL; + face_index = -face_index; + } + #ifdef FT_DEBUG_LEVEL_TRACE FT_TRACE3(( "FT_Open_Face: " )); if ( face_index < 0 ) -- GitLab