AuroraMiddleware/harfbuzz
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[avar] Fix out-of-bound read when input is bigger than all the coords

Browse Source 
'i' shouldn't become equal to array's length which as the increament
is happened at end of the loop, if the input is bigger than all the
table coords, it will be equal to array's length.

Fixes https://crbug.com/oss-fuzz/21092
This commit is contained in:
Ebrahim Byagowi 2020-03-07 11:53:12 +03:30
parent 6924e29f62
commit 0d729b4b72
2 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/hb-ot-var-avar-table.hh
View File

@ -79,7 +79,7 @@ struct SegmentMaps : ArrayOf<AxisValueMap>
return value - arrayZ[0].fromCoord + arrayZ[0].toCoord; return value - arrayZ[0].fromCoord + arrayZ[0].toCoord;
unsigned int i; unsigned int i;
unsigned int count = len; unsigned int count = len - 1;
for (i = 1; i < count && value > arrayZ[i].fromCoord; i++) for (i = 1; i < count && value > arrayZ[i].fromCoord; i++)
; ;

BIN
test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-draw-fuzzer-5681465586352128 Normal file
View File

Binary file not shown.