walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[subset] fix fuzzer timeout in layout closure 

Bail out of chain context lookup expansion once the lookup limit is encountered.
This commit is contained in:
Garret Rieger 2020-03-25 23:32:28 -07:00 committed by GitHub
parent f0ce56bbd0
commit 4ad686b9c0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/hb-ot-layout-gsubgpos.hh
View File

@ -76,6 +76,11 @@ struct hb_closure_context_t :
nesting_level_left++;
}
bool lookup_limit_exceeded ()
{
return lookup_count > HB_MAX_LOOKUP_INDICES;
}
bool should_visit_lookup (unsigned int lookup_index)
{
if (lookup_count++ > HB_MAX_LOOKUP_INDICES)
@ -159,6 +164,11 @@ struct hb_closure_lookups_context_t :
void set_lookup_inactive (unsigned lookup_index)
{ inactive_lookups->add (lookup_index); }
bool lookup_limit_exceeded ()
{
return lookup_count > HB_MAX_LOOKUP_INDICES;
}
bool is_lookup_visited (unsigned lookup_index)
{
if (lookup_count++ > HB_MAX_LOOKUP_INDICES)
@ -2074,6 +2084,10 @@ struct ChainRule
void closure (hb_closure_context_t *c,
ChainContextClosureLookupContext &lookup_context) const
{
if (c->lookup_limit_exceeded ()) {
return;
}
const HeadlessArrayOf<HBUINT16> &input = StructAfter<HeadlessArrayOf<HBUINT16>> (backtrack);
const ArrayOf<HBUINT16> &lookahead = StructAfter<ArrayOf<HBUINT16>> (input);
const ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord>> (lookahead);
@ -2087,6 +2101,10 @@ struct ChainRule
void closure_lookups (hb_closure_lookups_context_t *c) const
{
if (c->lookup_limit_exceeded ()) {
return;
}
const HeadlessArrayOf<HBUINT16> &input = StructAfter<HeadlessArrayOf<HBUINT16>> (backtrack);
const ArrayOf<HBUINT16> &lookahead = StructAfter<ArrayOf<HBUINT16>> (input);
const ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord>> (lookahead);
@ -2253,6 +2271,10 @@ struct ChainRuleSet
}
void closure (hb_closure_context_t *c, ChainContextClosureLookupContext &lookup_context) const
{
if (c->lookup_limit_exceeded ()) {
return;
}
return
+ hb_iter (rule)
| hb_map (hb_add (this))
@ -2262,6 +2284,10 @@ struct ChainRuleSet
void closure_lookups (hb_closure_lookups_context_t *c) const
{
if (c->lookup_limit_exceeded ()) {
return;
}
return
+ hb_iter (rule)
| hb_map (hb_add (this))

BIN
test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5713850117914624 Normal file
View File

Binary file not shown.