diff --git a/src/graph/graph.hh b/src/graph/graph.hh index 8a947ab24..825a35594 100644 --- a/src/graph/graph.hh +++ b/src/graph/graph.hh @@ -58,6 +58,13 @@ struct graph_t unsigned start = l.position; unsigned end = start + l.width - 1; + if (unlikely (l.width < 2 || l.width > 4)) + { + DEBUG_MSG (SUBSET_REPACK, nullptr, + "Invalid graph. Invalid link width."); + return false; + } + if (unlikely (end >= table_size ())) { DEBUG_MSG (SUBSET_REPACK, nullptr, diff --git a/test/fuzzing/hb-repacker-fuzzer.cc b/test/fuzzing/hb-repacker-fuzzer.cc index 837f415c3..b670af6e8 100644 --- a/test/fuzzing/hb-repacker-fuzzer.cc +++ b/test/fuzzing/hb-repacker-fuzzer.cc @@ -111,8 +111,6 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size) if (links[i].parent >= num_objects || links[i].child > links[i].parent) // Enforces DAG graph goto end; - - if (links[i].width < 2 || links[i].width > 4) goto end; } add_links_to_objects (objects, num_objects,