b263371b09
Merge pull request #3398 from harfbuzz/buffer-verify
...
Add HB_BUFFER_FLAG_VERIFY
2022-02-12 15:06:47 -06:00
af407dd24d
Add a fuzzer font
2022-02-12 14:22:35 -06:00
4e2f409bce
[subset] Don't hold references to members of the active_glyph_stack.
...
These references may get invalidated after the vector for the stack is resized. Fixes: https://oss-fuzz.com/testcase-detail/5422577634377728
2022-01-31 22:58:53 +02:00
61856359cb
[fuzz] Disable verification for now.
2022-01-28 14:07:29 -07:00
6596e42d16
[fuzz] Verify shape results
2022-01-28 13:55:24 -07:00
e2e305066a
Fix various typos
...
Found via `codespell -q 3 -S ./perf/texts -L actualy,ba,beng,fo,gir,inout,nd,ot,pres,ro,te,teh,timne`
2022-01-16 05:39:03 -08:00
87496bf63e
[subset] fix fuzzer timeout if visisted_paint goes into error.
2022-01-13 11:08:24 -08:00
067f90a820
[subset] Fix for fuzzer timeout.
...
Fixes https://oss-fuzz.com/testcase-detail/5549945449480192
In prune_langsys: move LangSys visited check up before any work is done for a LangSys. In this particular case the compare() method is responsible for the majority of the time spent and wasn't being guarded with a visisted check.
2021-12-14 17:34:21 -07:00
c4573c2ec7
[repacker] don't infinite loop if visited or roots is in error.
...
Fixes https://oss-fuzz.com/testcase-detail/5205038086094848
2021-12-14 15:57:48 -07:00
69d8f27c69
[meson] Require 0.55.0
...
We implicitly require it for building ragel subproject. This new version
requirement should satisfied in both Fedora 33 and Debian bullseye, and
not be too cutting edge for us.
2021-11-22 03:11:36 +02:00
ace98cc65f
[subset] Only sanitize recursion depth in COLR.
2021-11-10 10:34:46 -07:00
f51b48c8e7
[subset] Fix fuzzer found memory leak.
...
Happens because an insert into a map with an invalid key reports successful, but this causes the set being inserted to be lost.
2021-11-02 17:00:07 -07:00
0a7563a53f
[subset] fuzzer fix: https://oss-fuzz.com/testcase?key=6254792024915968
...
Make sure input is valid, each gid has a corresponding offset value in
the map
2021-11-02 15:25:18 -07:00
85deddb16e
[subset] fuzzer fix: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40406
2021-10-27 16:16:15 -07:00
794b00db4b
[subset] fuzzer fix: https://oss-fuzz.com/testcase-detail/6616166961905664
2021-09-29 10:29:06 -06:00
74f96d9d4b
[repacker] fix heap use after free in repacker.
...
Don't store a reference to the link in overflow records as the link object may be freed if the sorted graph vector is resized.
2021-09-19 09:06:17 -06:00
fb07f8f876
During subset input creation check for set alloc failures and fail if encountered.
2021-08-24 10:59:14 -06:00
dc31920bbe
Don't serialize null offsets in CPAL.
...
Fixes https://oss-fuzz.com/testcase-detail/5443213648330752
2021-08-18 16:52:45 -06:00
c0f3af91b8
[subset] speed up add_gid_and_children and adjust op limit.
...
Fix for fuzzer timeout: https://oss-fuzz.com/testcase-detail/5001604901240832 .
- Operation limit is per glyph, so 100,000 should still be far more than needed.
- Switches from for(...) to while(...) loop for iteration. for(...) calls it.end() which in this case triggers a complete iteration.
- Cache CompositeGlyph size in the iterator to avoid needing to recalculate it.
2021-08-12 14:50:42 -06:00
c08f1b8903
[map] fix incorrect population count in hash map.
...
If the same key was set twice the population was being incorrectly incremented.
2021-08-10 14:00:55 -06:00
8c0c217b5a
[subset] fail reference blob in face builder if allocation for table sorting fails.
...
Fixes https://oss-fuzz.com/testcase-detail/5041767803125760
2021-08-06 15:54:41 -06:00
5086e10538
[test] Add failing fuzzer test case
...
From https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36236
https://oss-fuzz.com/testcase-detail/5061207689134080
2021-08-04 11:55:53 -06:00
f9d8e4a976
[subset] switch ..._set_flags to not take a mask.
2021-07-29 18:30:27 -07:00
3d534b146c
[subset] convert subset input flags into bit flags.
...
Store the flags in a bit set. Updates the public api to work with the bit set directly.
2021-07-29 18:02:34 -07:00
0ded6a70c8
[subset] Fix another fuzzer issue
...
Addition could overflow on 32bit arch.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36636
Fixes https://oss-fuzz.com/testcase-detail/5072358514753536
2021-07-28 11:35:27 -06:00
09474d8d7b
[subset] Fix fuzzer timeout in add_gid_and_children.
...
The composite glyph graph isn't check for max operations by sanitize so track an operations count during the graph traversal.
2021-07-27 13:30:06 -06:00
c68a00b92e
[subset] Fix possible overflows in VarRegionList serialize
...
Fixes https://oss-fuzz.com/testcase-detail/5362189182566400
2021-07-27 13:28:09 -06:00
9ab751ac9f
[subset] Remove hb_subset(). Leaving just hb_subset_or_fail().
2021-07-22 12:14:47 -07:00
942636ae13
[subset] Remove hb_subset_input_get/set_retain_gids.
2021-07-22 12:12:36 -07:00
8bf5d4d4f7
[subset] Remove hb_subset_input_get/set_drop_hints.
2021-07-22 12:12:36 -07:00
7416faceeb
[subset] fuzzer fix: https://oss-fuzz.com/testcase-detail/5715464591376384
2021-07-08 09:09:30 -07:00
bc06af977f
[subset] speed up feature collection when tags are specified.
...
Precompute a feature index filter to avoid needing to iterate the feature tag list for each encountered feature index. For this particular fuzzer case speeds up feature collection from 50s to 2s.
2021-06-20 17:45:19 -07:00
675ebbeb3a
[subset] don't alloc zero bytes.
...
It will be leaked later since hb_blob_create() won't set up the blob to cleanup since it has length zero.
2021-06-16 17:35:39 -06:00
bdfed8f113
[blob] Add failing versions of create API
...
Fixes https://github.com/harfbuzz/harfbuzz/issues/2567
New API:
+hb_blob_create_or_fail()
+hb_blob_create_from_file_or_fail()
Use these in util/ to distinguish empty file from not-found file.
Only err on the latter.
2021-06-15 13:56:30 -06:00
35d6af6943
[subset] fix fuzzer testcase: https://oss-fuzz.com/testcase-detail/5965777994907648
2021-06-04 18:16:23 -06:00
1b6008ca62
fix fuzzer testcase: https://oss-fuzz.com/testcase-detail/5417934246772736
2021-06-02 17:32:16 -06:00
7ab0f4eda9
fuzzer fix
2021-05-31 12:44:33 -06:00
425ba1f4ab
[subset] fixes infinite loop in hb_set_get_max().
...
Fixes https://oss-fuzz.com/testcase-detail/5363902507515904
2021-04-20 13:18:07 -06:00
ec4321068b
[subset] fix infinite loop caused by alloc failure in repacker.
...
Fixes: https://oss-fuzz.com/testcase-detail/5609112151916544 .
2021-04-20 13:18:07 -06:00
0e845d973e
[subset] fix memory leak in repacker caused by failed alloc.
...
Fixes: https://oss-fuzz.com/testcase-detail/5616763250278400 .
2021-04-20 13:18:07 -06:00
3fb62cdc14
[subset] fail on offset overflow in tables that we don't repack.
...
Fixes: https://oss-fuzz.com/testcase-detail/5229304507138048
2021-04-19 17:01:05 -06:00
9dc9f0385d
[subset] fix for fuzzer testcase: https://oss-fuzz.com/testcase-detail/5858518134554624
2021-04-09 11:07:28 -06:00
4af5dacedc
[subset] add fuzzer testcase
2021-04-07 13:02:04 -06:00
64122b5a44
[subset] don't visit lookup if covered glyph set has failed.
...
If covered glyph set is in error then the same lookup can be recursed into repeatedly potentially causing a fuzzer timeout. Fixes: https://oss-fuzz.com/testcase-detail/5416421032067072 .
2021-04-06 12:34:44 -06:00
71d6d15600
[subset] clamp distance to prevent shifting outside of the limits of int64.
...
Fixes https://oss-fuzz.com/testcase-detail/4961171477233664 .
2021-04-06 11:48:39 -06:00
c5c13006a1
[subset] fix memory leaks found in https://oss-fuzz.com/testcase-detail/5179935334465536
2021-03-31 12:37:45 -06:00
adca4ce071
[subset] fixes https://oss-fuzz.com/testcase-detail/6173520787800064 .
...
Caused by incorrect bounds check in glyph closure for context lookups.
2021-03-30 15:44:41 -06:00
752e393ad2
[subset] avoid calling clear on null pool set.
2021-03-30 15:12:52 -06:00
8741914a80
[subset] fix memory leak when map insert fails.
2021-03-29 18:02:32 -06:00
5b6da6d2f0
[subset] add fuzzer test case.
2021-03-29 17:41:07 -06:00
Behdad Esfahbod
Garret Rieger
luz paz
Khaled Hosny
Qunxin Liu