diff --git a/src/graph/graph.hh b/src/graph/graph.hh index 372f05e5b..dc5b6a36f 100644 --- a/src/graph/graph.hh +++ b/src/graph/graph.hh @@ -1187,6 +1187,11 @@ struct graph_t } } + for (unsigned i = 0; i < vertices_.length; i++) + // parents arrays must be accurate or downstream operations like cycle detection + // and sorting won't work correctly. + check_success (!vertices_[i].parents.in_error ()); + parents_invalid = false; } diff --git a/src/hb-repacker.hh b/src/hb-repacker.hh index 6817ffae4..7a3143cec 100644 --- a/src/hb-repacker.hh +++ b/src/hb-repacker.hh @@ -393,6 +393,14 @@ hb_resolve_overflows (const T& packed, return nullptr; } + if (sorted_graph.in_error ()) + { + // Allocations failed somewhere + DEBUG_MSG (SUBSET_REPACK, nullptr, + "Graph is in error, likely due to a memory allocation error."); + return nullptr; + } + if (!hb_resolve_graph_overflows (table_tag, max_rounds, recalculate_extensions, sorted_graph)) return nullptr; diff --git a/test/fuzzing/graphs/clusterfuzz-testcase-minimized-hb-repacker-fuzzer-6014493291577344 b/test/fuzzing/graphs/clusterfuzz-testcase-minimized-hb-repacker-fuzzer-6014493291577344 new file mode 100644 index 000000000..a29d1e2fb Binary files /dev/null and b/test/fuzzing/graphs/clusterfuzz-testcase-minimized-hb-repacker-fuzzer-6014493291577344 differ