walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[subset] sbix fix missed offset is_null() check

This commit is contained in:
ckitagawa-work 2020-01-24 12:16:08 -05:00 committed by Ebrahim Byagowi
parent 5532374f61
commit 0e4b2676bd
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/hb-ot-color-sbix-table.hh
View File

@ -41,7 +41,8 @@ namespace OT {
struct SBIXGlyph struct SBIXGlyph
{ {
SBIXGlyph* copy (hb_serialize_context_t *c, unsigned int data_length) const { SBIXGlyph* copy (hb_serialize_context_t *c, unsigned int data_length) const
{
TRACE_SERIALIZE (this); TRACE_SERIALIZE (this);
SBIXGlyph* new_glyph = c->start_embed<SBIXGlyph> (); SBIXGlyph* new_glyph = c->start_embed<SBIXGlyph> ();
if (unlikely (!new_glyph)) return_trace (nullptr); if (unlikely (!new_glyph)) return_trace (nullptr);
@ -152,7 +153,9 @@ struct SBIXStrike
{ {
hb_codepoint_t old_gid; hb_codepoint_t old_gid;
if (!c->plan->old_gid_for_new_gid (new_gid, &old_gid) || if (!c->plan->old_gid_for_new_gid (new_gid, &old_gid) ||
unlikely (imageOffsetsZ[old_gid + 1] <= imageOffsetsZ[old_gid] || unlikely (imageOffsetsZ[old_gid].is_null() ||
imageOffsetsZ[old_gid + 1].is_null () ||
imageOffsetsZ[old_gid + 1] <= imageOffsetsZ[old_gid] ||
imageOffsetsZ[old_gid + 1] - imageOffsetsZ[old_gid] <= SBIXGlyph::min_size) || imageOffsetsZ[old_gid + 1] - imageOffsetsZ[old_gid] <= SBIXGlyph::min_size) ||
(unsigned int) imageOffsetsZ[old_gid + 1] > available_len) (unsigned int) imageOffsetsZ[old_gid + 1] > available_len)
{ {
@ -162,7 +165,7 @@ struct SBIXStrike
has_glyphs = true; has_glyphs = true;
unsigned int delta = imageOffsetsZ[old_gid + 1] - imageOffsetsZ[old_gid]; unsigned int delta = imageOffsetsZ[old_gid + 1] - imageOffsetsZ[old_gid];
unsigned int glyph_data_length = delta - SBIXGlyph::min_size; unsigned int glyph_data_length = delta - SBIXGlyph::min_size;
if (!(this + imageOffsetsZ[old_gid]).copy (c->serializer, glyph_data_length)) if (!(this+imageOffsetsZ[old_gid]).copy (c->serializer, glyph_data_length))
return_trace (false); return_trace (false);
out->imageOffsetsZ[new_gid] = head; out->imageOffsetsZ[new_gid] = head;
head += delta; head += delta;

BIN
test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5747280156295168 Normal file
View File

Binary file not shown.