walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[subset] check for addition overflow in hdmx size calculation. 

Fixes https://oss-fuzz.com/testcase-detail/4877336988483584.
This commit is contained in:
Garret Rieger 2022-12-21 21:52:28 +00:00 committed by Behdad Esfahbod
parent d77fca997e
commit 40342c9437
2 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/hb-ot-hdmx-table.hh
View File

@ -156,6 +156,7 @@ struct hdmx
TRACE_SANITIZE (this); TRACE_SANITIZE (this);
return_trace (c->check_struct (this) && return_trace (c->check_struct (this) &&
!hb_unsigned_mul_overflows (numRecords, sizeDeviceRecord) && !hb_unsigned_mul_overflows (numRecords, sizeDeviceRecord) &&
min_size + numRecords * sizeDeviceRecord > numRecords * sizeDeviceRecord &&
sizeDeviceRecord >= DeviceRecord::min_size && sizeDeviceRecord >= DeviceRecord::min_size &&
c->check_range (this, get_size ())); c->check_range (this, get_size ()));
} }

BIN
test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4877336988483584 Normal file
View File

Binary file not shown.