diff --git a/src/hb-ot-layout-gsubgpos.hh b/src/hb-ot-layout-gsubgpos.hh index 9c4710bc1..0c682aeee 100644 --- a/src/hb-ot-layout-gsubgpos.hh +++ b/src/hb-ot-layout-gsubgpos.hh @@ -76,6 +76,11 @@ struct hb_closure_context_t : nesting_level_left++; } + bool lookup_limit_exceeded () + { + return lookup_count > HB_MAX_LOOKUP_INDICES; + } + bool should_visit_lookup (unsigned int lookup_index) { if (lookup_count++ > HB_MAX_LOOKUP_INDICES) @@ -159,6 +164,11 @@ struct hb_closure_lookups_context_t : void set_lookup_inactive (unsigned lookup_index) { inactive_lookups->add (lookup_index); } + bool lookup_limit_exceeded () + { + return lookup_count > HB_MAX_LOOKUP_INDICES; + } + bool is_lookup_visited (unsigned lookup_index) { if (lookup_count++ > HB_MAX_LOOKUP_INDICES) @@ -2074,6 +2084,10 @@ struct ChainRule void closure (hb_closure_context_t *c, ChainContextClosureLookupContext &lookup_context) const { + if (c->lookup_limit_exceeded ()) { + return; + } + const HeadlessArrayOf &input = StructAfter> (backtrack); const ArrayOf &lookahead = StructAfter> (input); const ArrayOf &lookup = StructAfter> (lookahead); @@ -2087,6 +2101,10 @@ struct ChainRule void closure_lookups (hb_closure_lookups_context_t *c) const { + if (c->lookup_limit_exceeded ()) { + return; + } + const HeadlessArrayOf &input = StructAfter> (backtrack); const ArrayOf &lookahead = StructAfter> (input); const ArrayOf &lookup = StructAfter> (lookahead); @@ -2253,6 +2271,10 @@ struct ChainRuleSet } void closure (hb_closure_context_t *c, ChainContextClosureLookupContext &lookup_context) const { + if (c->lookup_limit_exceeded ()) { + return; + } + return + hb_iter (rule) | hb_map (hb_add (this)) @@ -2262,6 +2284,10 @@ struct ChainRuleSet void closure_lookups (hb_closure_lookups_context_t *c) const { + if (c->lookup_limit_exceeded ()) { + return; + } + return + hb_iter (rule) | hb_map (hb_add (this)) diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5713850117914624 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5713850117914624 new file mode 100644 index 000000000..51cf483dc Binary files /dev/null and b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5713850117914624 differ