diff --git a/src/hb-aat-layout-ankr-table.hh b/src/hb-aat-layout-ankr-table.hh index 4235b363a..497b2ea2f 100644 --- a/src/hb-aat-layout-ankr-table.hh +++ b/src/hb-aat-layout-ankr-table.hh @@ -69,8 +69,8 @@ struct ankr if (!offset) return Null(Anchor); const GlyphAnchors &anchors = StructAtOffset (&(this+anchorData), *offset); - /* TODO Use sanitizer; to avoid overflows and more. */ - if (unlikely ((const char *) &anchors + anchors.get_size () > end)) + if (unlikely (end - (const char *) &anchors < anchors.len.static_size || + end - (const char *) &anchors < anchors.get_size ())) return Null(Anchor); return anchors[i]; } @@ -80,7 +80,8 @@ struct ankr TRACE_SANITIZE (this); return_trace (likely (c->check_struct (this) && version == 0 && - lookupTable.sanitize (c, this))); + lookupTable.sanitize (c, this) && + anchorData.sanitize (c, this) /* Just one byte. */)); } protected: diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-harfbuzz_fuzzer-5126525414014976 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-harfbuzz_fuzzer-5126525414014976 new file mode 100644 index 000000000..74cc0273b Binary files /dev/null and b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-harfbuzz_fuzzer-5126525414014976 differ