AuroraMiddleware/harfbuzz
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Guard against underflow when adjusting length (#421)

Browse Source 
* Guard against underflow when adjusting length

With the fuzz-testcase in mozilla bug 1295299, we end up with a recursed lookup that removes 3 items, when `match_positions[idx]` is 0, which results in (unsigned) `end` wrapping to a huge value.

Making `end` a signed int is probably the simplest route to a fix.

Fixes https://bugzilla.mozilla.org/show_bug.cgi?id=1295299.

* Add testcase for #421.
This commit is contained in:
jfkthame 2017-02-17 03:03:24 +00:00 committed by Behdad Esfahbod
parent 45766b673f
commit 44f7d6ecde
3 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/hb-ot-layout-gsubgpos-private.hh
View File

@ -959,7 +959,7 @@ static inline bool apply_lookup (hb_apply_context_t *c,
TRACE_APPLY (NULL);
hb_buffer_t *buffer = c->buffer;
unsigned int end;
int end;
/* All positions are distance from beginning of *output* buffer.
* Adjust. */
@ -998,8 +998,8 @@ static inline bool apply_lookup (hb_apply_context_t *c,
/* Recursed lookup changed buffer len. Adjust. */
end = int (end) + delta;
if (end <= match_positions[idx])
end += delta;
if (end <= int (match_positions[idx]))
{
/* End might end up being smaller than match_positions[idx] if the recursed
* lookup ended up removing many items, more than we have had matched.

BIN
test/shaping/fonts/sha1sum/558661aa659912f4d30ecd27bd09835171a8e2b0.ttf Normal file
View File

Binary file not shown.

1
test/shaping/tests/fuzzed.tests
View File

@ -10,3 +10,4 @@ fonts/sha1sum/3511ff5c1647150595846ac414c595cccac34f18.ttf:--font-funcs=ot:U+004
fonts/sha1sum/fab39d60d758cb586db5a504f218442cd1395725.ttf:--font-funcs=ot:U+0041,U+0041:[gid0=0+1000|gid0=1+1000]
fonts/sha1sum/205edd09bd3d141cc9580f650109556cc28b22cb.ttf:--font-funcs=ot:U+0041:[gid0=0+1000]
fonts/sha1sum/217a934cfe15c548b572c203dceb2befdf026462.ttf:--font-funcs=ot:U+0061,U+0061,U+0061:[]
fonts/sha1sum/558661aa659912f4d30ecd27bd09835171a8e2b0.ttf:--font-funcs=ot:U+FFFD,U+E0100,U+FFFD,U+E0010:[]