From 535c8d13c2f3cf95414d0db85f017c0def1be456 Mon Sep 17 00:00:00 2001
From: Calixte Denizet <calixte.denizet@gmail.com>
Date: Thu, 2 Apr 2026 18:13:10 +0200
Subject: [PATCH] Fix wrong values when sanitizing fonts

NPUSHW: push signed 16-bits integer: https://learn.microsoft.com/en-us/typography/opentype/spec/tt_instructions#push-n-words
indexToLocFormat: field in the 'head' table: https://developer.apple.com/fonts/TrueType-Reference-Manual/RM06/Chap6head.html#:~:text=indexToLocFormat,-0
---
 src/core/fonts.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/core/fonts.js b/src/core/fonts.js
index 452490926..73f77833c 100644
--- a/src/core/fonts.js
+++ b/src/core/fonts.js
@@ -2029,7 +2029,7 @@ class Font {
         data[3] = 0;
       }
 
-      const indexToLocFormat = int16(data[50], data[51]);
+      const indexToLocFormat = signedInt16(data[50], data[51]);
       if (indexToLocFormat < 0 || indexToLocFormat > 1) {
         info(
           "Attempting to fix invalid indexToLocFormat in head table: " +
@@ -2397,7 +2397,7 @@ class Font {
           } else {
             for (j = 0; j < n; j++) {
               b = data[i++];
-              stack.push((b << 8) | data[i++]);
+              stack.push(signedInt16(b, data[i++]));
             }
           }
         } else if ((op & 0xf8) === 0xb0) {