walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fuzzer fix: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49790

This commit is contained in:
Qunxin Liu 2022-08-05 13:33:22 -07:00 committed by Behdad Esfahbod
parent a4e0fd1685
commit 7fde6ab025
3 changed files with 20 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
src/hb-ot-layout-common.hh
View File

@ -84,10 +84,10 @@ using OT::Layout::MediumTypes;
namespace OT { namespace OT {
template<typename Iterator> template<typename Iterator>
static inline void ClassDef_serialize (hb_serialize_context_t *c, static inline bool ClassDef_serialize (hb_serialize_context_t *c,
Iterator it); Iterator it);
static void ClassDef_remap_and_serialize ( static bool ClassDef_remap_and_serialize (
hb_serialize_context_t *c, hb_serialize_context_t *c,
const hb_set_t &klasses, const hb_set_t &klasses,
bool use_class_zero, bool use_class_zero,
@ -1380,17 +1380,14 @@ struct LookupOffsetList : List16OfOffsetTo<TLookup, OffsetType>
*/ */
static void ClassDef_remap_and_serialize (hb_serialize_context_t *c, static bool ClassDef_remap_and_serialize (hb_serialize_context_t *c,
const hb_set_t &klasses, const hb_set_t &klasses,
bool use_class_zero, bool use_class_zero,
hb_sorted_vector_t<hb_pair_t<hb_codepoint_t, hb_codepoint_t>> &glyph_and_klass, /* IN/OUT */ hb_sorted_vector_t<hb_pair_t<hb_codepoint_t, hb_codepoint_t>> &glyph_and_klass, /* IN/OUT */
hb_map_t *klass_map /*IN/OUT*/) hb_map_t *klass_map /*IN/OUT*/)
{ {
if (!klass_map) if (!klass_map)
{ return ClassDef_serialize (c, glyph_and_klass.iter ());
ClassDef_serialize (c, glyph_and_klass.iter ());
return;
}
/* any glyph not assigned a class value falls into Class zero (0), /* any glyph not assigned a class value falls into Class zero (0),
* if any glyph assigned to class 0, remapping must start with 0->0*/ * if any glyph assigned to class 0, remapping must start with 0->0*/
@ -1413,7 +1410,7 @@ static void ClassDef_remap_and_serialize (hb_serialize_context_t *c,
} }
c->propagate_error (glyph_and_klass, klasses); c->propagate_error (glyph_and_klass, klasses);
ClassDef_serialize (c, glyph_and_klass.iter ()); return ClassDef_serialize (c, glyph_and_klass.iter ());
} }
/* /*
@ -1495,11 +1492,12 @@ struct ClassDefFormat1_3
? hb_len (hb_iter (glyph_map.keys()) | hb_filter (glyph_filter)) ? hb_len (hb_iter (glyph_map.keys()) | hb_filter (glyph_filter))
: glyph_map.get_population (); : glyph_map.get_population ();
use_class_zero = use_class_zero && glyph_count <= glyph_and_klass.length; use_class_zero = use_class_zero && glyph_count <= glyph_and_klass.length;
ClassDef_remap_and_serialize (c->serializer, if (!ClassDef_remap_and_serialize (c->serializer,
orig_klasses, orig_klasses,
use_class_zero, use_class_zero,
glyph_and_klass, glyph_and_klass,
klass_map); klass_map))
return_trace (false);
return_trace (keep_empty_table || (bool) glyph_and_klass); return_trace (keep_empty_table || (bool) glyph_and_klass);
} }
@ -1736,11 +1734,12 @@ struct ClassDefFormat2_4
? hb_len (hb_iter (glyphset) | hb_filter (glyph_filter)) ? hb_len (hb_iter (glyphset) | hb_filter (glyph_filter))
: glyph_map.get_population (); : glyph_map.get_population ();
use_class_zero = use_class_zero && glyph_count <= glyph_and_klass.length; use_class_zero = use_class_zero && glyph_count <= glyph_and_klass.length;
ClassDef_remap_and_serialize (c->serializer, if (!ClassDef_remap_and_serialize (c->serializer,
orig_klasses, orig_klasses,
use_class_zero, use_class_zero,
glyph_and_klass, glyph_and_klass,
klass_map); klass_map))
return_trace (false);
return_trace (keep_empty_table || (bool) glyph_and_klass); return_trace (keep_empty_table || (bool) glyph_and_klass);
} }
@ -2124,9 +2123,9 @@ struct ClassDef
}; };
template<typename Iterator> template<typename Iterator>
static inline void ClassDef_serialize (hb_serialize_context_t *c, static inline bool ClassDef_serialize (hb_serialize_context_t *c,
Iterator it) Iterator it)
{ c->start_embed<ClassDef> ()->serialize (c, it); } { return (c->start_embed<ClassDef> ()->serialize (c, it)); }
/* /*

2
src/hb-serialize.hh
View File

@ -315,7 +315,7 @@ struct hb_serialize_context_t
{ {
object_t *obj = current; object_t *obj = current;
if (unlikely (!obj)) return; if (unlikely (!obj)) return;
if (unlikely (in_error())) return; if (unlikely (in_error() && !only_overflow ())) return;
current = current->next; current = current->next;
revert (obj->head, obj->tail); revert (obj->head, obj->tail);

BIN
test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-6362213417353216 Normal file
View File

Binary file not shown.