walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[ENOMEM] make serializer modification operations no-ops if it's in an error state.

This commit is contained in:
Garret Rieger 2020-07-29 15:18:25 -07:00 committed by Ebrahim Byagowi
parent d1f1301490
commit 42237adffc
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/hb-serialize.hh
View File

@ -172,6 +172,8 @@ struct hb_serialize_context_t
propagate_error (packed, packed_map); propagate_error (packed, packed_map);
if (unlikely (!current)) return; if (unlikely (!current)) return;
if (unlikely (in_error())) return;
assert (!current->next); assert (!current->next);
/* Only "pack" if there exist other objects... Otherwise, don't bother. /* Only "pack" if there exist other objects... Otherwise, don't bother.
@ -187,6 +189,8 @@ struct hb_serialize_context_t
template <typename Type = void> template <typename Type = void>
Type *push () Type *push ()
{ {
if (unlikely (in_error ())) return start_embed<Type> ();
object_t *obj = object_pool.alloc (); object_t *obj = object_pool.alloc ();
if (unlikely (!obj)) if (unlikely (!obj))
check_success (false); check_success (false);
@ -203,6 +207,8 @@ struct hb_serialize_context_t
{ {
object_t *obj = current; object_t *obj = current;
if (unlikely (!obj)) return; if (unlikely (!obj)) return;
if (unlikely (in_error())) return;
current = current->next; current = current->next;
revert (obj->head, obj->tail); revert (obj->head, obj->tail);
obj->fini (); obj->fini ();
@ -217,6 +223,8 @@ struct hb_serialize_context_t
{ {
object_t *obj = current; object_t *obj = current;
if (unlikely (!obj)) return 0; if (unlikely (!obj)) return 0;
if (unlikely (in_error())) return 0;
current = current->next; current = current->next;
obj->tail = head; obj->tail = head;
obj->next = nullptr; obj->next = nullptr;
@ -260,6 +268,7 @@ struct hb_serialize_context_t
void revert (snapshot_t snap) void revert (snapshot_t snap)
{ {
if (unlikely (in_error ())) return;
assert (snap.current == current); assert (snap.current == current);
current->links.shrink (snap.num_links); current->links.shrink (snap.num_links);
revert (snap.head, snap.tail); revert (snap.head, snap.tail);
@ -267,6 +276,7 @@ struct hb_serialize_context_t
void revert (char *snap_head, void revert (char *snap_head,
char *snap_tail) char *snap_tail)
{ {
if (unlikely (in_error ())) return;
assert (snap_head <= head); assert (snap_head <= head);
assert (tail <= snap_tail); assert (tail <= snap_tail);
head = snap_head; head = snap_head;
@ -276,6 +286,7 @@ struct hb_serialize_context_t
void discard_stale_objects () void discard_stale_objects ()
{ {
if (unlikely (in_error ())) return;
while (packed.length > 1 && while (packed.length > 1 &&
packed.tail ()->head < tail) packed.tail ()->head < tail)
{ {
@ -294,6 +305,7 @@ struct hb_serialize_context_t
unsigned bias = 0) unsigned bias = 0)
{ {
static_assert (sizeof (T) == 2 || sizeof (T) == 4, ""); static_assert (sizeof (T) == 2 || sizeof (T) == 4, "");
if (unlikely (in_error ())) return;
if (!objidx) if (!objidx)
return; return;
@ -445,6 +457,8 @@ struct hb_serialize_context_t
template <typename Type> template <typename Type>
Type *extend_size (Type *obj, unsigned int size) Type *extend_size (Type *obj, unsigned int size)
{ {
if (unlikely (in_error ())) return nullptr;
assert (this->start <= (char *) obj); assert (this->start <= (char *) obj);
assert ((char *) obj <= this->head); assert ((char *) obj <= this->head);
assert ((char *) obj + size >= this->head); assert ((char *) obj + size >= this->head);

BIN
test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-6231212713312256 Normal file
View File

Binary file not shown.