walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #3432 from harfbuzz/fuzz-verify 

[fuzz-shape] Verify shape output

https://github.com/harfbuzz/harfbuzz/pull/3432
This commit is contained in:
Behdad Esfahbod 2022-06-01 12:26:08 +01:00 committed by GitHub
parent 9c0c31dfaa e246723f0c
commit a31fd97c35
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/hb-buffer.cc
View File

@ -311,6 +311,7 @@ hb_buffer_t::enter ()
{ {
deallocate_var_all (); deallocate_var_all ();
serial = 0; serial = 0;
shaping_failed = false;
scratch_flags = HB_BUFFER_SCRATCH_FLAG_DEFAULT; scratch_flags = HB_BUFFER_SCRATCH_FLAG_DEFAULT;
if (likely (!hb_unsigned_mul_overflows (len, HB_BUFFER_MAX_LEN_FACTOR))) if (likely (!hb_unsigned_mul_overflows (len, HB_BUFFER_MAX_LEN_FACTOR)))
{ {
@ -330,6 +331,7 @@ hb_buffer_t::leave ()
max_ops = HB_BUFFER_MAX_OPS_DEFAULT; max_ops = HB_BUFFER_MAX_OPS_DEFAULT;
deallocate_var_all (); deallocate_var_all ();
serial = 0; serial = 0;
// Intentionally not reseting shaping_failed, such that it can be inspected.
} }

2
src/hb-ot-shape.cc
View File

@ -1159,8 +1159,6 @@ hb_propagate_flags (hb_buffer_t *buffer)
static void static void
hb_ot_shape_internal (hb_ot_shape_context_t *c) hb_ot_shape_internal (hb_ot_shape_context_t *c)
{ {
c->buffer->enter ();
/* Save the original direction, we use it later. */ /* Save the original direction, we use it later. */
c->target_direction = c->buffer->props.direction; c->target_direction = c->buffer->props.direction;

10
src/hb-shape.cc
View File

@ -129,6 +129,8 @@ hb_shape_full (hb_font_t *font,
if (unlikely (!buffer->len)) if (unlikely (!buffer->len))
return true; return true;
buffer->enter ();
hb_buffer_t *text_buffer = nullptr; hb_buffer_t *text_buffer = nullptr;
if (buffer->flags & HB_BUFFER_FLAG_VERIFY) if (buffer->flags & HB_BUFFER_FLAG_VERIFY)
{ {
@ -140,8 +142,12 @@ hb_shape_full (hb_font_t *font,
features, num_features, features, num_features,
font->coords, font->num_coords, font->coords, font->num_coords,
shaper_list); shaper_list);
buffer->shaping_failed = false;
hb_bool_t res = hb_shape_plan_execute (shape_plan, font, buffer, features, num_features); hb_bool_t res = hb_shape_plan_execute (shape_plan, font, buffer, features, num_features);
if (buffer->max_ops <= 0)
buffer->shaping_failed = true;
hb_shape_plan_destroy (shape_plan); hb_shape_plan_destroy (shape_plan);
if (text_buffer) if (text_buffer)
@ -157,6 +163,8 @@ hb_shape_full (hb_font_t *font,
hb_buffer_destroy (text_buffer); hb_buffer_destroy (text_buffer);
} }
buffer->leave ();
return res; return res;
} }

4
test/fuzzing/hb-shape-fuzzer.cc
View File

@ -33,7 +33,7 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
{ {
const char text[] = "ABCDEXYZ123@_%&)*$!"; const char text[] = "ABCDEXYZ123@_%&)*$!";
hb_buffer_t *buffer = hb_buffer_create (); hb_buffer_t *buffer = hb_buffer_create ();
// hb_buffer_set_flags (buffer, HB_BUFFER_FLAG_VERIFY); hb_buffer_set_flags (buffer, (hb_buffer_flags_t) (HB_BUFFER_FLAG_VERIFY /* | HB_BUFFER_FLAG_PRODUCE_UNSAFE_TO_CONCAT */));
hb_buffer_add_utf8 (buffer, text, -1, 0, -1); hb_buffer_add_utf8 (buffer, text, -1, 0, -1);
hb_buffer_guess_segment_properties (buffer); hb_buffer_guess_segment_properties (buffer);
hb_shape (font, buffer, nullptr, 0); hb_shape (font, buffer, nullptr, 0);
@ -51,7 +51,7 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
text32[10] = test_font (font, text32[15]) % 256; text32[10] = test_font (font, text32[15]) % 256;
hb_buffer_t *buffer = hb_buffer_create (); hb_buffer_t *buffer = hb_buffer_create ();
// hb_buffer_set_flags (buffer, HB_BUFFER_FLAG_VERIFY); // hb_buffer_set_flags (buffer, (hb_buffer_flags_t) (HB_BUFFER_FLAG_VERIFY | HB_BUFFER_FLAG_PRODUCE_UNSAFE_TO_CONCAT));
hb_buffer_add_utf32 (buffer, text32, sizeof (text32) / sizeof (text32[0]), 0, -1); hb_buffer_add_utf32 (buffer, text32, sizeof (text32) / sizeof (text32[0]), 0, -1);
hb_buffer_guess_segment_properties (buffer); hb_buffer_guess_segment_properties (buffer);
hb_shape (font, buffer, nullptr, 0); hb_shape (font, buffer, nullptr, 0);