From 60eae9d0cfc05bd14f3081e4bb128de868fc5e93 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Sun, 9 May 2021 22:46:46 +0200
Subject: FoFiTrueType::cvtSfnts: Protect against integer overflow

oss-fuzz/34113
---
 fofi/FoFiTrueType.cc | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc
index a720be94..7a3f8c58 100644
--- a/fofi/FoFiTrueType.cc
+++ b/fofi/FoFiTrueType.cc
@@ -1295,9 +1295,14 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
             newTables[k].checksum = checksum;
             newTables[k].offset = pos;
             newTables[k].len = length;
-            pos += length;
-            if (pos & 3) {
-                pos += 4 - (length & 3);
+            int newPos;
+            if (unlikely(checkedAdd(pos, length, &newPos))) {
+                ok = false;
+            } else {
+                pos = newPos;
+                if (pos & 3) {
+                    pos += 4 - (length & 3);
+                }
             }
             ++k;
         }
-- 
cgit v1.2.3