grub/files/CVE-2022-3775.patch

6 The expression (ctx.bounds.height - combining_glyphs[i]->height) / 2 may
7 evaluate to a very big invalid value even if both ctx.bounds.height and
8 combining_glyphs[i]->height are small integers. For example, if
9 ctx.bounds.height is 10 and combining_glyphs[i]->height is 12, this
11 coordinates are allowed to be negative but ctx.bounds.height is an
16 This patch fixes the problem by casting ctx.bounds.height to int. As
19 uses of ctx.bounds.height (and ctx.bounds.width) are also casted to int,
43    ctx.bounds.height = main_glyph->height;
46 -  above_righty = ctx.bounds.y + ctx.bounds.height;
47 +  above_righty = ctx.bounds.y + (int) ctx.bounds.height;
50 -  above_lefty = ctx.bounds.y + ctx.bounds.height;
51 +  above_lefty = ctx.bounds.y + (int) ctx.bounds.height;
71 -		   (ctx.bounds.height - combining_glyphs[i]->height) / 2
72 -		   - (ctx.bounds.height + ctx.bounds.y), &ctx);
73 +		   ((int) ctx.bounds.height - combining_glyphs[i]->height) / 2
74 +		   - ((int) ctx.bounds.height + ctx.bounds.y), &ctx);
82 -		   -(ctx.bounds.height + ctx.bounds.y + space
83 +		   -((int) ctx.bounds.height + ctx.bounds.y + space
84  		     + combining_glyphs[i]->height), &ctx);
91 -		   -(ctx.bounds.height / 2 + ctx.bounds.y
92 +		   -((int) ctx.bounds.height / 2 + ctx.bounds.y
93  		     + combining_glyphs[i]->height / 2), &ctx);