walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[subset] fix buffer overflow fuzzer reported issue.

This commit is contained in:
Garret Rieger 2023-03-24 17:30:53 +00:00 committed by Behdad Esfahbod
parent 79ae6b657f
commit be87200106
2 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/hb-subset-plan.cc
View File

@ -812,12 +812,15 @@ _normalize_axes_location (hb_face_t *face, hb_subset_plan_t *plan)
bool has_avar = face->table.avar->has_data (); bool has_avar = face->table.avar->has_data ();
const OT::SegmentMaps *seg_maps = nullptr; const OT::SegmentMaps *seg_maps = nullptr;
unsigned avar_axis_count = 0;
if (has_avar) if (has_avar)
{
seg_maps = face->table.avar->get_segment_maps (); seg_maps = face->table.avar->get_segment_maps ();
avar_axis_count = face->table.avar->get_axis_count();
}
bool axis_not_pinned = false; bool axis_not_pinned = false;
unsigned old_axis_idx = 0, new_axis_idx = 0; unsigned old_axis_idx = 0, new_axis_idx = 0;
unsigned int i = 0;
for (const auto& axis : axes) for (const auto& axis : axes)
{ {
hb_tag_t axis_tag = axis.get_axis_tag (); hb_tag_t axis_tag = axis.get_axis_tag ();
@ -832,7 +835,7 @@ _normalize_axes_location (hb_face_t *face, hb_subset_plan_t *plan)
else else
{ {
int normalized_v = axis.normalize_axis_value (plan->user_axes_location.get (axis_tag)); int normalized_v = axis.normalize_axis_value (plan->user_axes_location.get (axis_tag));
if (has_avar && old_axis_idx < face->table.avar->get_axis_count ()) if (has_avar && old_axis_idx < avar_axis_count)
{ {
normalized_v = seg_maps->map (normalized_v); normalized_v = seg_maps->map (normalized_v);
} }
@ -840,14 +843,13 @@ _normalize_axes_location (hb_face_t *face, hb_subset_plan_t *plan)
if (normalized_v != 0) if (normalized_v != 0)
plan->pinned_at_default = false; plan->pinned_at_default = false;
plan->normalized_coords[i] = normalized_v; plan->normalized_coords[old_axis_idx] = normalized_v;
} }
if (has_avar)
seg_maps = &StructAfter<OT::SegmentMaps> (*seg_maps);
old_axis_idx++; old_axis_idx++;
i++; if (has_avar && old_axis_idx < avar_axis_count)
seg_maps = &StructAfter<OT::SegmentMaps> (*seg_maps);
} }
plan->all_axes_pinned = !axis_not_pinned; plan->all_axes_pinned = !axis_not_pinned;
} }

BIN
test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5120246288875520 Normal file
View File

Binary file not shown.