walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[ENOMEM] in GSUB ChainContext subsetting check maps for allocation errors.

This commit is contained in:
Garret Rieger 2020-07-31 15:56:14 -07:00 committed by Ebrahim Byagowi
parent fb1477795c
commit 06dbb6acbb
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/hb-ot-layout-gsubgpos.hh
View File

@ -2777,13 +2777,19 @@ struct ChainContextFormat2
hb_map_t backtrack_klass_map; hb_map_t backtrack_klass_map;
out->backtrackClassDef.serialize_subset (c, backtrackClassDef, this, &backtrack_klass_map); out->backtrackClassDef.serialize_subset (c, backtrackClassDef, this, &backtrack_klass_map);
if (unlikely (!c->serializer->check_success (!backtrack_klass_map.in_error ())))
return_trace (false);
// subset inputClassDef based on glyphs survived in Coverage subsetting // subset inputClassDef based on glyphs survived in Coverage subsetting
hb_map_t input_klass_map; hb_map_t input_klass_map;
out->inputClassDef.serialize_subset (c, inputClassDef, this, &input_klass_map); out->inputClassDef.serialize_subset (c, inputClassDef, this, &input_klass_map);
if (unlikely (!c->serializer->check_success (!input_klass_map.in_error ())))
return_trace (false);
hb_map_t lookahead_klass_map; hb_map_t lookahead_klass_map;
out->lookaheadClassDef.serialize_subset (c, lookaheadClassDef, this, &lookahead_klass_map); out->lookaheadClassDef.serialize_subset (c, lookaheadClassDef, this, &lookahead_klass_map);
if (unlikely (!c->serializer->check_success (!lookahead_klass_map.in_error ())))
return_trace (false);
unsigned non_zero_index = 0, index = 0; unsigned non_zero_index = 0, index = 0;
bool ret = true; bool ret = true;

BIN
test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4880059756969984 Normal file
View File

Binary file not shown.