walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[glyf] Add an edge-count limit 

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55246
This commit is contained in:
Behdad Esfahbod 2023-01-20 08:21:43 -07:00
parent 2cfd4133fb
commit d06976e68f
2 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/OT/glyf/Glyph.hh
View File

@ -207,9 +207,14 @@ struct Glyph
bool use_my_metrics = true, bool use_my_metrics = true,
bool phantom_only = false, bool phantom_only = false,
hb_array_t<int> coords = hb_array_t<int> (), hb_array_t<int> coords = hb_array_t<int> (),
unsigned int depth = 0) const unsigned int depth = 0,
unsigned *edge_count = nullptr) const
{ {
if (unlikely (depth > HB_MAX_NESTING_LEVEL)) return false; if (unlikely (depth > HB_MAX_NESTING_LEVEL)) return false;
unsigned stack_edge_count = 0;
if (!edge_count) edge_count = &stack_edge_count;
if (unlikely (*edge_count > HB_GLYF_MAX_EDGE_COUNT)) return false;
(*edge_count)++;
if (!coords) if (!coords)
coords = hb_array (font->coords, font->num_coords); coords = hb_array (font->coords, font->num_coords);
@ -316,7 +321,8 @@ struct Glyph
use_my_metrics, use_my_metrics,
phantom_only, phantom_only,
coords, coords,
depth + 1))) depth + 1,
edge_count)))
return false; return false;
/* Copy phantom points from component if USE_MY_METRICS flag set */ /* Copy phantom points from component if USE_MY_METRICS flag set */
@ -381,7 +387,8 @@ struct Glyph
use_my_metrics, use_my_metrics,
phantom_only, phantom_only,
coord_setter.get_coords (), coord_setter.get_coords (),
depth + 1))) depth + 1,
edge_count)))
return false; return false;
/* Apply component transformation */ /* Apply component transformation */

4
src/hb-limits.hh
View File

@ -93,6 +93,10 @@
#define HB_GLYF_MAX_POINTS 10000 #define HB_GLYF_MAX_POINTS 10000
#endif #endif
#ifndef HB_GLYF_MAX_EDGE_COUNT
#define HB_GLYF_MAX_EDGE_COUNT 1024
#endif
#ifndef HB_CFF_MAX_OPS #ifndef HB_CFF_MAX_OPS
#define HB_CFF_MAX_OPS 10000 #define HB_CFF_MAX_OPS 10000
#endif #endif