From 03085132bac6bb3f69378cab3eaf5a57ad1362ff Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Mon, 21 Mar 2022 18:06:33 -0600
Subject: [PATCH] [buffer] Fix out-buffer under memory-alloc failure

This was broken in July refactoring of the buffer, and exposed to
ReverseChainSingleSubstFormat1 in 3807061d634b60bd6235d6e1d8c47a034377f924

Fixes:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38800
https://bugs.chromium.org/p/chromium/issues/detail?id=1303552
---
 src/hb-buffer.cc                                 |   1 +
 ...se-minimized-hb-shape-fuzzer-5349416110784512 | Bin 0 -> 1603 bytes
 2 files changed, 1 insertion(+)
 create mode 100644 test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-5349416110784512

diff --git a/src/hb-buffer.cc b/src/hb-buffer.cc
index d36fcfde3..7122792f4 100644
--- a/src/hb-buffer.cc
+++ b/src/hb-buffer.cc
@@ -404,6 +404,7 @@ hb_buffer_t::sync ()
 
 reset:
   have_output = false;
+  out_info = info;
   out_len = 0;
   idx = 0;
 }
diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-5349416110784512 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-5349416110784512
new file mode 100644
index 0000000000000000000000000000000000000000..7c71adaa6504335c1cba28cf5f00501f2f1e32e7
GIT binary patch
literal 1603
zcmb_c-%C?b9RHlNIj1;L@S!ARrh!Y1nQn9C!!m6Jk%IJCZmub^HD%5hgP8pRBE3Zk
zz4h8d_#6a1)l&#P^x#`BJr$HP*y-~<+f}E_Ao^bJx#xb*_s8da&gWhz04_i9_9xsx
zZy*rZ-TeXg7>fS*^wbQRaf=bLvJVsSnY-hko^5`Rci@RBohi8>`OWCU08}<v$iXXR
zP{@C`D=L%Dix1dB8&@<u9KBpSoNElz?`KRe3u~M2#$~?yjWGmqq~p1I9q*iCwwj=6
z7oaKwwDJiSt}*fbi`5i4^5WDw+<ywLV+^=T4jURHRR(5B0U_JX$E3)qEK5Kg^69+k
z*VnjPhx`;<!(D0D54A?~p^=x667wWDjx87i_1JvWAQt-9m_p1~FqvC@IG4_^EH30)
z=%Q0&E}u+g(m)y0MnAINV26Fw4x$CeoVkKt9(1_c=ES1#;1UD-;uDiMN>jLRlRCa3
zAtL<z`YT0vHC6_0iwFnjmvRh<DNE0rdLopK@x0N%iOO84im<}2NbKc?gTR=Iz@;|#
z4uoY8D?(@!Q;i%XfrNNCb)((7g(}gL`BglKmDk$H;Ba^}G!lt~MuVg8pKoqeLI<Ov
zP&67H!8&#tfSqEom|Q8O^FAqGRR+PgaxPXpr2&@@BL4y<G8_rA@lbduQUhf*h;^Q0
z{|Spv+v8DtZ8*D;5cZ*7TxZ8lN<&y~Mh^l|59YH4`|;~skF4%lOdPUHsVqqo+N`dQ
ze}r<Fx#V(ENUO1@C;k&*obMd#dY3~J{48gB7cY`5H#R|GYMWf*NP$7*E$Cv^PhD#y
zmc7tH?IU8CFI<y#N$z%%r9y48Aa?O`^LC0F?mh<X;ATXbx15>N)FP=ry!tO@p^qEc
z>^}Sc0i*1X)>w@Y*=uZ5YugQd^i#MJ(E`uDgn_I=e$~p%%F{i-`I1Y1%3@wur#zU^
Oq->r-cd)JP9`GA3&vy&}

literal 0
HcmV?d00001