[Libreoffice-commits] core.git: vcl/source

[Stephan Bergmann (via logerrit)]

 vcl/source/fontsubset/cff.cxx |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit 8bc286821e54699006b612a72739380098678b18
Author:     Stephan Bergmann <sbergman at redhat.com>
AuthorDate: Tue May 28 15:08:21 2019 +0200
Commit:     Stephan Bergmann <sbergman at redhat.com>
CommitDate: Tue May 28 17:06:55 2019 +0200

    Avoid -fsanitize=signed-integer-overflow
    
    ...with e.g. `--convert-to pdf abw/abi10006-1.abw` as obtained by
    bin/get-bugzilla-attachments-by-mimetype, reporting
    
    > vcl/source/fontsubset/cff.cxx:1697:63: runtime error: signed integer overflow: 55810 * 52845 cannot be represented in type 'int'
    
    and
    
    > vcl/source/fontsubset/cff.cxx:1137:38: runtime error: signed integer overflow: 233492066 * 52845 cannot be represented in type 'int'
    
    Using unsigned here is faithful to the algorithm presented in Chapter 7
    Encryption of "Adobe Type 1 Font Format" (<http://wwwimages.adobe.com/
    www.adobe.com/content/dam/acom/en/devnet/font/pdfs/T1_SPEC.pdf>).
    
    Change-Id: Ic27a5ebbe5f766fef425d241e14487ea4ae81da4
    Reviewed-on: https://gerrit.libreoffice.org/73104
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sbergman at redhat.com>

diff --git a/vcl/source/fontsubset/cff.cxx b/vcl/source/fontsubset/cff.cxx
index 57824367d366..d9abcca4ef45 100644
--- a/vcl/source/fontsubset/cff.cxx
+++ b/vcl/source/fontsubset/cff.cxx
@@ -1131,7 +1131,7 @@ int CffSubsetterContext::convert2Type1Ops( CffLocal* pCffLocal, const U8* const
     const int nType1Len = mpWritePtr - pT1Ops;
 
     // encrypt the Type1 charstring
-    int nRDCryptR = 4330; // TODO: mnRDCryptSeed;
+    unsigned nRDCryptR = 4330; // TODO: mnRDCryptSeed;
     for( U8* p = pT1Ops; p < mpWritePtr; ++p) {
         *p ^= (nRDCryptR >> 8);
         nRDCryptR = (*p + nRDCryptR) * 52845 + 22719;
@@ -1591,7 +1591,7 @@ public:
 private:
     FILE*       mpFileOut;
     char        maBuffer[MAX_T1OPS_SIZE];   // TODO: dynamic allocation
-    int         mnEECryptR;
+    unsigned    mnEECryptR;
 public:
     char*       mpPtr;