[GPOS] Fix assert fail introduced recently

Was introduced in 8708b9e081.

If these lookups are recursed to from (Chain)Context out-of-order,
it was possible that last_base > buffer->idx, in which case we
were attaching marks to a base after them... and an assertion
was failing fortunately.

Fixes https://oss-fuzz.com/testcase-detail/6377756666757120
This commit is contained in:
Behdad Esfahbod 2023-02-07 15:50:36 -07:00
parent 840e1b6b84
commit 64fa5cd482
3 changed files with 10 additions and 0 deletions

View File

@ -122,6 +122,11 @@ struct MarkBasePosFormat1_2
hb_ot_apply_context_t::skipping_iterator_t &skippy_iter = c->iter_input; hb_ot_apply_context_t::skipping_iterator_t &skippy_iter = c->iter_input;
skippy_iter.set_lookup_props (LookupFlag::IgnoreMarks); skippy_iter.set_lookup_props (LookupFlag::IgnoreMarks);
if (c->last_base_until > buffer->idx)
{
c->last_base_until = 0;
c->last_base = -1;
}
unsigned j; unsigned j;
for (j = buffer->idx; j > c->last_base_until; j--) for (j = buffer->idx; j > c->last_base_until; j--)
{ {

View File

@ -104,6 +104,11 @@ struct MarkLigPosFormat1_2
hb_ot_apply_context_t::skipping_iterator_t &skippy_iter = c->iter_input; hb_ot_apply_context_t::skipping_iterator_t &skippy_iter = c->iter_input;
skippy_iter.set_lookup_props (LookupFlag::IgnoreMarks); skippy_iter.set_lookup_props (LookupFlag::IgnoreMarks);
if (c->last_base_until > buffer->idx)
{
c->last_base_until = 0;
c->last_base = -1;
}
unsigned j; unsigned j;
for (j = buffer->idx; j > c->last_base_until; j--) for (j = buffer->idx; j > c->last_base_until; j--)
{ {