From c0fac016dc017596e2d979e19e1eb8f88df38ea3 Mon Sep 17 00:00:00 2001 From: Garret Rieger Date: Wed, 22 Feb 2023 20:54:20 +0000 Subject: [PATCH] [subset] update the subset fuzzer to be able to reach instancing code. --- test/fuzzing/fonts/AdobeVFPrototype.ABC.otf | Bin 0 -> 4724 bytes test/fuzzing/fonts/Roboto-Variable.ABC.ttf | Bin 0 -> 13480 bytes test/fuzzing/hb-subset-fuzzer.cc | 49 ++++++++++++++++---- 3 files changed, 41 insertions(+), 8 deletions(-) create mode 100644 test/fuzzing/fonts/AdobeVFPrototype.ABC.otf create mode 100644 test/fuzzing/fonts/Roboto-Variable.ABC.ttf diff --git a/test/fuzzing/fonts/AdobeVFPrototype.ABC.otf b/test/fuzzing/fonts/AdobeVFPrototype.ABC.otf new file mode 100644 index 0000000000000000000000000000000000000000..ab1c925e449f94feec783a988f1bfdca9dc6c89f GIT binary patch literal 4724 zcmb_f3vg7`8UD}RN0LJzmlzX`2$v8-KnNl7sA4qys!@`2XqFZ|svWUh6h-me~WhE;! zr6(~z=2PG=EL^!N|MW+v&k-e@06uL|S>B4zaxVW3_#c38SOWZM!=X(?@@(L>B`as< zJmjfwAc__GHm)qqD?K~@uYl#JfdAc6YpG7FN^c}e%mqGsbERb`#Zxc%FA01r=Fd%^ zRz);61pGwB7E5_jTq*ctGl9>o03oJK`Wf(@z|$)#YwEdyo&~-UxLj$e-$}-00NFTn z<|<3&mJ^n9Wkhk1H$AY^y1Qoh9m+v`HJDe3z-uIu$V72hUW`u<8^;dZf*GQ9ge8M- zqAwN6x2sSiSlT(*Y;pCp)r!kAS{wm0>Wq%8)Q#;ecp8Ll9M0eVI}ajt7|f-&PnzRr=!c=HJxLa%suk>3roIO!rd;1+bui42y>^)-Q_;sq~fV3 ztqqfS%%y-^mHoo=xf7FJ4ybg21mQbgn^eZTG~r3TNZKW6du0y(93WC$$zS+BWUY(Ib6Z!Oy1Mxbh>+N z4wv04r(T%t2dO69=Q{ejS*`-4YM9gU5+gK^^r=RF)B=Zqh9rs{~( zx!aY(-(MY;AmmCJb*jJasMEQp)dA)1l=%4fgW8m81BB7xWj7&?`@{}3QVek#Lt`n4 zQYe*fr-?L~rqT?WMRVvb`Z48EA>EH7u$)%WTG~LHXe(7xHPzC7YM~BtkQWE|Fg-?3 z(68tv`YrvA-lX5t`*fZ@rOzo$UoiuVV+kyUjc4g>s#I%OXQ(vT3?h1`)8UqHRFIqF&ezXHtxerb=D=vC>#p> zZ6Sa-A_y5<3ub~XhvA3tp@e5}Px>?*(?f0kM(jH5^lsTy{L0>eN)Xa`WWv--;njHA zrSNUfzp}6FRqJ!@zUJy|KDZNS*nhC6qqjQ*DPIvkUY*WQmwW8pk9Rs;&i!}6BX?K# zp+1~wMt0+BcHee%{xb@1S)*{ljkpKkX16eo zlyn@tk1u_ub|tTlWWLttYijP@8)({pXx9dxul-<)YYjhBZnJq?5YM_5i}$SvBJ(bH z-$Wi5?CuPBY#w`0OVDHYz{l{uQ#54@Gbd+M-PS_+ZLev7-yyZk(I(<7TcSsJDc9@+Qr zd9ExTsF})3PL%*}_-bCz53Q}ort*J;tAD z;Jzt5a;(h>or1pJ=RgXN?;dQHdMD7oEEag29%tI)N z4Lt)0D=?dHKDwN*=U=}1AWoGrlH3rgozFL?@!*+=vf1vxpC77PhQnYECpR<>&ga;t zJ)R6)Y@*WPYAc+%r0C&bqr^Q4{-s8%s##;!dLtPm#=N2;N)Blah>Nw6ZJ-=cxh137U^1E{ zNmNSV*T|DskY9pAn@0H&GIMQHRYmmz~pLT;5Ww4#(1TDN%>xuKLM1 zWlQ(!^id>BRXQ9`IZ~qzkEU4Z866%&)1=cnoB;hF>aYy`pX%^fnr65~hZAX$Azz1Y zq6~vWhm)wl@C+>=EA6DcC>Yym8&yyZvXFyaGK=N{%EMY&QBt-5&Qxb>z57ByUes9d>wHBkf|KF@dwcKb) zyLoYe4!wZ7qDxFfE864g6cR&Va^+(9!=jk#}7`f^h=SfLg z9Z1IA$1$HuY{!=BDjH8xK~ZrjjeEpWQ$^!c5izTAiwZ-i1q_3P&)Wiw71;mUUm6Wx zrrhCoaRYD?bt?J@SjC4wreg4{82(VjS+nXHdT3K&Qen}Hn6>{u(Ti9701B!`7aj=D z<1s>7^?8iyb0Wp6G<0g!(mWS6jd0gQA0dBr1#^UjZ(Tvbt7S>lN%nzqd2IYe_+liJ z(JUxp8dfD5x4Wj=DvMqSFBaBS4_GW4t!o!nMQox9r;}8-t)hk@;|rFS zu0Ty>lt>w<5KD2!Yw`1O1b_d6pO}fxVi4^=Xc{esiQNPoUltlo!mo%|!`Y<~zER>U zMBtKRgf?1wLBkEo2ra?Tj%5QbM%X|mwWR_^bgNFoXOz0{1-^KMCgDEPa52Ihn#h-g zSYv67h*NmaI@U~7wG%Ulm{nfUsZz{{IJGD-Ff)rmFJcr}EW?_K=v0ieQE*Y;wJct& zuZT#U8^aRx7=SXFjny%nR+h-{cc^**i!4d?Q^Xo0cGLMc-b+?Blu5@@x1}^@e3msM MmvSKx-D?8-FZGsYfB*mh literal 0 HcmV?d00001 diff --git a/test/fuzzing/fonts/Roboto-Variable.ABC.ttf b/test/fuzzing/fonts/Roboto-Variable.ABC.ttf new file mode 100644 index 0000000000000000000000000000000000000000..6cf001fc854c4f501f2a4bf4dfcb66a28f8aeafe GIT binary patch literal 13480 zcmbVT31AdO)~@RAxiT}kAmNxmPiSU15(p#^!l4Wa2{+_~Ot>;RLGBQ)6(o}c#1St* z1y|kG6egL9R|-vdDoLynpLzv`YGAg=y@&2)FYqh7sw_0_AI znS@Y6NHlH&DI7O8J;Sw5dXJD^qrfd0mpLtG`KB-8LI05uY8jW4m-@SH(V>J$e}TMq z{PZ!|x6OOwVM2Nj0{!o4ISGlC6THU=(F>ppb8^SzZc(P*MTny_+Q)lVdMYyRa_I=^ zQwjN~;zgdN#6li{ehKIy#VafABd{;~coESggZ)j(gSUK>SRRQM69Hr ztFvG*gjlV5VzyW~BhOXnIAaBgON>j57@m+ce0WksQes5Xpuv<%G>OtaNtBO@9m>5O z==ly8x1K%}=)te&2ApX*s!M1(rjwg8bqU_4OwRV?ljx9OWWpx&){P8eeRb>SNqEE4q)<-kHIN%Rbja;oQet#;7il0Ep%$I&PTsuCv$Z&Jz^wZ{cW#+PKk$9AzOb%w$3r_B_Y|%@ z@nG53%!!-csNA|>|NU80w=h3E$|Yg2@C5vbco}Zo1usa#`$?mJn-Bb|eU@cM9$ofw zbw)<*Yn5BxU1r%Aa{J1;(^hBob4*^DS+aUGU9)UY*^~#~TUWO3y$7e1zO-V>;*mqk zx6Cfjf9Q_kDT~-#-U~!u67IuX4kmqFonmbLx^Wz}IVpA8c&jCBos}evPKxX@JRu=L zok$fn9i~$HrKyyHQyI!}*@1%`?J<5{O3I?lQ?JrTil1CIYV!T1;{u!J(r#1c4@)S` zyh!PozJ=b@kxL%uI&JPVDS6bC-Ypj4KIhcc+2dABF!*2J9-lpYWd7jIL;0-r6LQw& z_6P2<{)J`mUc-Hi%VH&Z-eRE!ew~hzgd})AJOSwYIn?I_mcLHVtf3PEE3LnypMUC~ z%zxVwE!@|dNQq2Nz8NaK3YA$0 z!!~~Z{DLyboLHZ_PCo6u?P+R! zvuy3j2TQkQWj%ak?dX!f_=<*3-HL?|e~=Ea`l856V!+&mlLUgS!<`RXfmkppA;ZX{ zb`1*y7BrdI)IBiKG&tD5)|}mqL=f(w z4+7If_n0mTu87)`KSs(}H^Hv77Mk~3os63{Z5(ltF(ge-0)&(q9^;6e&_6J-Fanu} zfaGy!CfKucaQvNt1UqN}FJ>`KQE(rlD9QoNKi9+^+aG=8?u{F2YpT6f>+f2(_Rim} zS-ooIipu2`%a$%#ylCNqJLb!P5HqUg0r6DUr^yDDDNl>D%dV{a*h$&>>0@oNv2L3b zE4yUDk@vyp`AX^t?|>PXt&XY{UD~~FjKnR;MR8KBlwS%{bw*-| z%`Hqr&C*(<_HpRJULQ`1a23yx>S?f6kT2T{%iQCkO*n_FzH{oyP-(SRFO==YcDt;1 zNJW|XzF3(SO12=KosWo7kIfe=#oFEOdgWjY)0SdkizBIZ65W(l=c1c(3i8pZY~Pfd zzlWn-T4AcYt~X@)^>!k=R4&K3jLB5&j3ARJW@Zm(RP}B3E+SW{QbA>?bTLMu@-(Ga zUBFRsJ*V-)RlPbV>j)AK5cvEu1%D@XrWeWtAkC90PK2NRcCV9;4Lg^tbMc!nv7S~#)Icf zt%D(SsSP}@eFS+0`7c@s?5lTZq_Q#~KD~~c8Yi{GIx8O&m|jPx#uWnElR)y0bUR=z zyK?fGZlMjBk9E7p4v1&yvgb>sHpyMrxwCI+I?PCQ9=)?L&X+GUkTGaU;UfT4-Z7zA z$|z(SSSWZ;0IPVqy-+SHj6>BPp5cSoUhHAoB)X2{9d%T2(A&xFh?L$Uhe)NVvRO)P zlZ+;#HHn@{3{t90qqR7vOX>Em^L@oq5isY<%rCchtW&|>ZZkI&cw20!?*iK(;pxM3j_6-q@KgRRG#dF3}V%AnPeCrxDC!P$w-Ydn1urSuYL zu**{-^T1uKy~M47gk-9j;un=*LINaIB|GL+HSP-^$&kV*$W;mi-afhfMsi*onE^4t zAUFnUSdj%M!&-i58$lesP_5V8rP+1O8z6);gOcsj=f zgx3Y=*;s44%wh9VlZMuQ0&8jua)QmkQ8O*uC$W=gE|@icwNCZSzHCw7CWmZvV4`IK zK4@YC8&0cDwGOAXHgE~OGRJUOAA7 z9k>uwq2zY6?(qifSPRv(PczKI1!0w!769PC%Sx2Zll)@e+DW#6124s8WU@6>cL8A8+7nW#SGonmVY@^uW2=Tx~5pzRo7F zm4y{0uhOOz%L;K}3T^UL$b>9fS|p83=4%tOK&p*dw6QeR`^q>Y?ESoz&-mLq0~FNR zlufE5EE_qE%&}kYiq|G+BI^LjmD7eXkqt$MKx0k&e8nD|sb+_=6>4!tfFFr54ad-i z2giokti`x9S?}-x16Il0d^UVDK%j!h3_&>Jcu<438NzT3{2&rq(C>OhVF3(kYoSAY zVNb<*P^>NtW{kC473W4RgI$Ht%3xP;C7FY()N)hS51QBJ)O4dzYBR<*da2DKqw1&y z$6vvwLyt~-IKnkTojNB*0@^pCjvAan1t2mU!yMuBnI&yYky!eFl@J$EkCViW?0h3b zUWcjo`Ha?EON=+`Th#_^@ne>)ZBJ$;xEw;#WOEujzhDAo6U##bF~95HVQ>Q~)Z;{l z?NDX0rPy(k?8;(~K%)sFzC=xCOtCd?W$KdF%-zh*&0mL3Sft)TFv4Yur_LG6E*lG- zia8l8V@aG_J94dK*r-;QRCS!)J|E|-G>X#}HcHg($Oh0hI@KiS!+~eM2U|1p5X(F6 zt~g6&v-2>{{8G4`jv}M94?>cLxE$;Of+K&FZMYksBQ`;x5?Q#E2 zjLj)67x}85%#&8fvRKrUIno*&7t$ozZl8suh^@Y!Oo?&(eArTb68j`Ioqe>yoe60@ z85G0L2kb1t{iF*SBy}^$`R$_^5N6Ois6d5ELjnkrW_HMq$uLzVROVq z!;XjxhbiKMVFScFhIJL^4^hN!r-ePW_0b-70j+pIG z#4N{dG1IAt)0|b})ZU6XMT!$AOS{EMk|Iu&ri&9mkME_3T!Tist zP=%No%)*_efFFb?-K-S2snBwcjS%Q@Tda61xr%dv;O8 z9?^;z6KxP}N!?;*b{!HOGqXFZbz!xrZnsD8D(EygGB09qcwVGC+-)6V$adC0% zxx8`(BN(YMSWTm8T>FbDQ1)gbR8Vl&THRD_WvWUYwX`-W`$ip2GcK+xen}uC3g1h0 zW|uI6eJ`ne-+BcKm22Qff&PvV@;W&{p1^A#zNvc@-~BRbBiT=OgYy{qn7l}K(6jjU zf>F;=GpQzjBYz~D$;0GTeD~LdYz6;LaxZy`oL2cyke7p2o`IdGVdrJ?CR$gM`=R+X z*#nyoksai(u>1!72lcDA$C2&mSF^u^`~j9_;w2kkcN^+^(Y_1GB*kPkSx0KXeGvLj z!;??QY3fA(_rQ-Q$WHPSzI|oCN)R%b%Vyug2`1F%;L_?8zr@T5);SVN?g-ZT4t$|Q zT}PbgQ){ayG2}_DjxRkd@JZ!UN zg7vP%PFsEMMtalpL4J1Cd;?oJ@N0 z`-A)`B$02mIhEWlga`T4$Pi&_u%1a$gz8{DizExJbC*p<2$zEV9FnN(AFSt+QMy^d zdL9{~+fLGuS(cJDq=L*R2n z9Ml&-Cx(ZF}}ZKr(=wNN$2J`|B_y76n{zHKE7YmY>)Xb+4}i>wj%bow`lk0*Q5FK z{{BC0e%qY@iotUbWE3yGdS{l{i9@?6YV5M8_rB2N2tIwgz|uu^E$d$-v?@6${D0@`}<0WZ*(iqgV$bf78u7$Q5F=3g096JVhZE0OJXaGRehbo}MwDwf)o4%lxS=SQZyDOYBxV)HjUA}x!@~_51i%HK8 zvEVSDJp9qAy@spzcE7bTzzKG4CdXMtEzA!4WtWgbTuX3mV517oCP-FXcy%nA^v3&H zD73b^2@fnnJP{t%F-WiwwgyO0ias4^X(9}C`gShSDWwmLv^H|e`p1(kO`MYb@@LjY zL0R`{zmR55sc1ACS`;O>$!uz7K)|um7}dE`gbHWYfl(b#XW*5Pc*3nJsho%NELl}P zuM!VBztXc1XHpJGipRiM?puqq_cQoX;C*tITv8n&)JZ0xJ-cS$VlHzy8M2kdX!d0D zO(?I{8I8Y&3i1TY#Cs)$};3rw?j0eXC8+K(B%an)9{sOx%8r=6-17 zh46OpK=avcJTqUb(d>yR0FzoDtUYLqn)XEv9R#m%#sdN(NhpgC8w>MEZ4V_DJ2eJu zeC#5WV#HdV>5ioWC^lL~rBkdvb)1aKpnBY4O_hzqX92>-rc&dn5#HwqsR_aL7A8s){p1CU-9kkv*-fJ@kp1NZjZ$- zb(Y1=PD&d3Hy3fCA=6?-rC7{a#=sxJ0i&$kuHGx@Gu&(Ze&I`9rhXPdi}-m5SZlQ{ zvv3wyl^$q~#T-hofxksVh7d?kmyXHR($fX|T025^xs=~og{BuGzdp0|?uQ=w_FM9R zm*muvoNE4Pa`Mp{(%D6}TF?A*(|LhuS=O$i>sO!wr&+_ggRYl{R=K- zF89*jzosgA%4%gb_x<4Yahh z_?xdcHX>O!dP$&`1gd#15a4RUc#1!N;uNGLy&i2jFS%Aru2u82v60rO<1E2AOE6A` z>^T@`VTW-RbQou%|M}-XAj2k4p4|WYgWI-=;=woHJn+_AZ=DEOTdr_Tx`ZojUdJi{w+U#pyhF@Zgb45&g5~&6`(iz{lyZu<*zzZ>JqQcI-ZO;Sv;} zasJ$Y{^!EgmfFM!v-$h)j=lQotM7h!wWQ?m;j89^2{UHQD0dIQpAA^9AFZpaJA669 z?>`@wk~MYe)QJPhK(FPkx2#rc)8~g@`uzhBJWy+BX}Em(%Kv=zgSXSNWy|IaiEKO$ zFRj*Zt}E0mD7Cs>7cai}WOb@i$zG=FKfdzacUP~zvh$v?$_izH`dX>KXZxQoUikC2 zvC1lCp88s;-?Hod_qT1^FjiTt6soTZx&;$d5Zlk6eIW? zE*&Jipr@4a&1Q25KB#*!8vzu>%X1KKz*65B=J)#p3PGM_GE}@&QEIKwYVkAOfWO7> z_x5UO)`~yiS2R8(ens)OXp$DvzDJgW;MD1phS6Z2ozDEPiZYtYAr1-ki%;8^@fIqjXEX_1iYP0CX+z`A3)@Q zHq~;iwvKXvuRP$Z82HKqzNU1*S9S+{^~*nc^zR>CY|uw^MTy`qoc`zGqet^+3~D%i zeBU4MN7;G!{Ke)3H-^Vwym<2KYD3GluTMH`7NI&STI$keSOFk5cgj%5$wSZn9`Jhl z?=}6l4jwKE%7xEAJc{zk$@AZEy@w_}{M4(*zcG!PTY=(9>#BSrKSj)5zGu&HuG-F- zqGQi|3#?Fj?W>a~-+gBD=FPhfpE(oTbHG(WMkm@rs;SxP zrB-vbA;gwA`q0sH*Q)8&%Qa5Hq8AK07Eu(1(;19{V8IE;Xwd6*KpBcor>9?jh)pgW&;Tj3TSEws`1ihe|0aWr528BX`-aX&#T~oG6M~#v;f0k z`ITxz)8$K7%weH$kAa&i@QE6&<|~&Q6au z6!(0Tg3(<9$6wm1p(RvBOO*ZWcPd)0o;!8w^*=oP@WVUb`1GtjcG&cV3m4`Mu1Qta zC`*+JUG1Mh8`6{taMvhzhWU2Z|NZpE>nImbAAV)$y)NZW;H1L4 zyB}u?F#!V<3s+r?g5DTn;&?TgFwp6cRCGF?BL;vf5U3HLhE*DcjL&Imm_@cc+2koT z7K9x6BfyYNskb|(9dp3&rD?DkW~vHl(Wbu!FhYBxR7WunS|OrP6$8j4HC1qqa@1== zN?`?=qq?)A0ZauMYYwDoC_q{f(AFQQjbg@{*_a#Q5k{dm8j(P?{iqcAq73N@5gyqo(%T6bsQcHCjh*^3jjI&OLlsu#K3KmzP&OeV~O4v0Oj4ckkZ!u0#X^=R=dH zVQZY|a*%#r%b`OSi^c!%4_^Nh@K9?Av@|t0e}C==Z|4OI7R(vdo%`Yt)A;84^`A&{ zlfO1@@0F_uUwFjl^F1mbx^(IK^+PW`es6Vk_2wsc*I)gy{@Djmzwep7pMJV)*NzPg zP^K@6(^fGOyDMm3W_#p;Gm&xE^H%$Tq{WYW}ryjbz1z$8rXGUh;1$mEZXjX zxwmxKbnz8qIdA3_^(6R~p*4qv&;gpF>AU!%@spAcMCKe&Ry++sVspfBo`8 zwNY;l3*nS&m#C%mNrxyG2y(aA;5Fh(JdEF zp8Ury9N?aL=bHvobmEj^oZe=qV7Hy2OjWX!GTl8-?fLNQh8p3@=Py6yOIOOloC;xq zvM}`Cr(XKxI~+(FE}s2o-BX*#D2tSt$fDWazsBi9L#-i5F6s#{ny-H#Ta!Xl)NLTbdgi8-aD4dyvW0 z!m2GT*ml^W!WOD*GBK>G=~MBVFr#ca;K)^D1fbcJaCAcq%h?d9kJcN{vN(=rf)^ZG ft7l6ES8WtlM@u6{d%YRCmc#$Xu+=Wq00{pJonEOq literal 0 HcmV?d00001 diff --git a/test/fuzzing/hb-subset-fuzzer.cc b/test/fuzzing/hb-subset-fuzzer.cc index f883a3d3c..52dc343dd 100644 --- a/test/fuzzing/hb-subset-fuzzer.cc +++ b/test/fuzzing/hb-subset-fuzzer.cc @@ -11,9 +11,9 @@ static void trySubset (hb_face_t *face, const hb_codepoint_t text[], int text_length, - unsigned flag_bits) + unsigned flag_bits, + hb_subset_input_t *input) { - hb_subset_input_t *input = hb_subset_input_create_or_fail (); if (!input) return; hb_subset_input_set_flags (input, (hb_subset_flags_t) flag_bits); @@ -63,20 +63,53 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size) '3', '@', '_', '%', '&', ')', '*', '$', '!' }; - trySubset (face, text, sizeof (text) / sizeof (hb_codepoint_t), flags); + hb_subset_input_t *input = hb_subset_input_create_or_fail (); + trySubset (face, text, sizeof (text) / sizeof (hb_codepoint_t), flags, input); + unsigned num_axes; hb_codepoint_t text_from_data[16]; - if (size > sizeof (text_from_data) + sizeof (flags)) { + if (size > sizeof (text_from_data) + sizeof (flags) + sizeof(num_axes)) { + hb_subset_input_t *input = hb_subset_input_create_or_fail (); + size -= sizeof (text_from_data); memcpy (text_from_data, - data + size - sizeof (text_from_data), + data + size, sizeof (text_from_data)); + size -= sizeof (flags); memcpy (&flags, - data + size - sizeof (text_from_data) - sizeof (flags), + data + size, sizeof (flags)); - unsigned int text_size = sizeof (text_from_data) / sizeof (hb_codepoint_t); - trySubset (face, text_from_data, text_size, flags); + size -= sizeof (num_axes); + memcpy (&num_axes, + data + size, + sizeof (num_axes)); + + if (num_axes > 0 && size > num_axes * (sizeof(hb_tag_t) + sizeof(float))) + { + for (unsigned i = 0; i < num_axes; i++) { + hb_tag_t tag; + int value; + size -= sizeof (tag); + memcpy (&tag, + data + size, + sizeof (tag)); + size -= sizeof (value); + memcpy (&value, + data + size, + sizeof (value)); + + hb_subset_input_pin_axis_location(input, + face, + tag, + (float) value); + } + } + + + + unsigned int text_size = sizeof (text_from_data) / sizeof (hb_codepoint_t); + trySubset (face, text_from_data, text_size, flags, input); } hb_face_destroy (face);