walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

In Coverage iterator, bail out if table smells 

In particular, if CoverageFormat2 has unsorted ranges, bail out.
Otherwise, 64k ranges of each 64k glyphs can DoS closure() method.

We can do the same for CoverageFormat1, but that one does not expose
the quadratic behavior, so, fine.
This commit is contained in:
Behdad Esfahbod 2018-06-23 10:32:28 -04:00
parent 941f2b8548
commit b2a1879187
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/hb-ot-layout-common-private.hh
View File

@ -832,7 +832,12 @@ struct CoverageFormat2
c = &c_; c = &c_;
coverage = 0; coverage = 0;
i = 0; i = 0;
j = c->rangeRecord.len ? c_.rangeRecord[0].start : 0; j = c->rangeRecord.len ? c->rangeRecord[0].start : 0;
if (unlikely (c->rangeRecord[0].start > c->rangeRecord[0].end))
{
/* Broken table. Skip. */
i = c->rangeRecord.len;
}
} }
inline bool more (void) { return i < c->rangeRecord.len; } inline bool more (void) { return i < c->rangeRecord.len; }
inline void next (void) inline void next (void)
@ -842,7 +847,14 @@ struct CoverageFormat2
i++; i++;
if (more ()) if (more ())
{ {
hb_codepoint_t old = j;
j = c->rangeRecord[i].start; j = c->rangeRecord[i].start;
if (unlikely (j <= old))
{
/* Broken table. Skip. Important to avoid DoS. */
i = c->rangeRecord.len;
return;
}
coverage = c->rangeRecord[i].value; coverage = c->rangeRecord[i].value;
} }
return; return;
@ -855,7 +867,8 @@ struct CoverageFormat2
private: private:
const struct CoverageFormat2 *c; const struct CoverageFormat2 *c;
unsigned int i, j, coverage; unsigned int i, coverage;
hb_codepoint_t j;
}; };
private: private: