walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[GSUB/GPOS] Fix sanitization in Format1 

Fixes https://oss-fuzz.com/testcase-detail/5120727025319936
This commit is contained in:
Behdad Esfahbod 2023-03-02 10:48:30 -07:00
parent 7897173870
commit 08784baf10
2 changed files with 16 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/OT/Layout/GPOS/SinglePosFormat1.hh
View File

@ -28,12 +28,14 @@ struct SinglePosFormat1
TRACE_SANITIZE (this); TRACE_SANITIZE (this);
return_trace (c->check_struct (this) && return_trace (c->check_struct (this) &&
coverage.sanitize (c, this) && coverage.sanitize (c, this) &&
valueFormat.sanitize_value (c, this, values) && /* The coverage table may use a range to represent a set
// The coverage table may use a range to represent a set * of glyphs, which means a small number of bytes can
// of glyphs, which means a small number of bytes can * generate a large glyph set. Manually modify the
// generate a large glyph set. Manually modify the * sanitizer max ops to take this into account.
// sanitizer max ops to take this into account. *
c->check_ops ((this + coverage).get_population () >> 1)); * Note: This check *must* be right after coverage sanitize. */
c->check_ops ((this + coverage).get_population () >> 1) &&
valueFormat.sanitize_value (c, this, values));
} }

14
src/OT/Layout/GSUB/SingleSubstFormat1.hh
View File

@ -25,12 +25,14 @@ struct SingleSubstFormat1_3
bool sanitize (hb_sanitize_context_t *c) const bool sanitize (hb_sanitize_context_t *c) const
{ {
TRACE_SANITIZE (this); TRACE_SANITIZE (this);
return_trace (coverage.sanitize (c, this) && return_trace (c->check_struct (this) &&
deltaGlyphID.sanitize (c) && coverage.sanitize (c, this) &&
// The coverage table may use a range to represent a set /* The coverage table may use a range to represent a set
// of glyphs, which means a small number of bytes can * of glyphs, which means a small number of bytes can
// generate a large glyph set. Manually modify the * generate a large glyph set. Manually modify the
// sanitizer max ops to take this into account. * sanitizer max ops to take this into account.
*
* Note: This check *must* be right after coverage sanitize. */
c->check_ops ((this + coverage).get_population () >> 1)); c->check_ops ((this + coverage).get_population () >> 1));
} }