walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[CFF] bad offset in Index (#1476) 

* Update hb-ot-cff-common.hh

* fix bug

* bummer fix wasn't hit. refix

* additional sanity check

* Added test cases for oss-fuzz issues 11805, 11806
This commit is contained in:
Michiharu Ariza 2018-12-12 18:08:15 -08:00 committed by Behdad Esfahbod
parent bcb4ecaf68
commit 798e98c47b
3 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/hb-ot-cff-common.hh
View File

@ -200,7 +200,13 @@ struct CFFIndex
} }
inline unsigned int length_at (unsigned int index) const inline unsigned int length_at (unsigned int index) const
{ return offset_at (index + 1) - offset_at (index); } {
if (likely ((offset_at (index + 1) >= offset_at (index)) &&
(offset_at (index + 1) <= offset_at (count))))
return offset_at (index + 1) - offset_at (index);
else
return 0;
}
inline const char *data_base (void) const inline const char *data_base (void) const
{ return (const char *)this + min_size + offset_array_size (); } { return (const char *)this + min_size + offset_array_size (); }
@ -211,7 +217,7 @@ struct CFFIndex
inline ByteStr operator [] (unsigned int index) const inline ByteStr operator [] (unsigned int index) const
{ {
if (likely (index < count)) if (likely (index < count))
return ByteStr (data_base () + offset_at (index) - 1, offset_at (index + 1) - offset_at (index)); return ByteStr (data_base () + offset_at (index) - 1, length_at (index));
else else
return Null(ByteStr); return Null(ByteStr);
} }

BIN
test/fuzzing/fonts/clusterfuzz-testcase-hb-subset-fuzzer-5643036478930944 Normal file
View File

Binary file not shown.

BIN
test/fuzzing/fonts/clusterfuzz-testcase-hb-subset-fuzzer-5686186874503168 Normal file
View File

Binary file not shown.