From: Michiharu Ariza <ariza@adobe.com>
Date: Thu, 6 Dec 2018 21:36:26 +0000 (-0800)
Subject: [CFF] Refix oss-fuzz 11714: set_blends (PR #1458) (#1460)
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=59345cdef38cf1f514a6a0eb6e8852350acb6166;p=platform%2Fupstream%2FlibHarfBuzzSharp.git

[CFF] Refix oss-fuzz 11714: set_blends (PR #1458) (#1460)

* pass subarray of stack to set_blends

* get_subarray to return a value, not ref

* restored error check (with tweak)
---

diff --git a/src/hb-cff-interp-common.hh b/src/hb-cff-interp-common.hh
index 9b595ff..effc081 100644
--- a/src/hb-cff-interp-common.hh
+++ b/src/hb-cff-interp-common.hh
@@ -576,6 +576,11 @@ struct ArgStack : Stack<ARG, 513>
     return true;
   }
 
+  inline hb_array_t<const ARG> get_subarray (unsigned int start) const
+  {
+    return S::elements.sub_array (start);
+  }
+
   private:
   typedef Stack<ARG, 513> S;
 };
diff --git a/src/hb-cff2-interp-cs.hh b/src/hb-cff2-interp-cs.hh
index 18e8468..8e296b6 100644
--- a/src/hb-cff2-interp-cs.hh
+++ b/src/hb-cff2-interp-cs.hh
@@ -52,7 +52,7 @@ struct BlendArg : Number
   inline void set_real (double v) { reset_blends (); Number::set_real (v); }
 
   inline void set_blends (unsigned int numValues_, unsigned int valueIndex_,
-			  unsigned int numBlends, const BlendArg *blends_)
+			  unsigned int numBlends, const hb_array_t<const BlendArg> &blends_)
   {
     numValues = numValues_;
     valueIndex = valueIndex_;
@@ -235,15 +235,19 @@ struct CFF2CSOpSet : CSOpSet<BlendArg, OPSET, CFF2CSInterpEnv, PARAM, PATH>
     env.process_blend ();
     k = env.get_region_count ();
     n = env.argStack.pop_uint ();
-    if (unlikely (env.argStack.get_count () < ((k+1) * n)))
+    /* copy the blend values into blend array of the default values */
+    unsigned int start = env.argStack.get_count () - ((k+1) * n);
+    /* let an obvious error case fail, but note CFF2 spec doesn't forbid n==0 */
+    if (unlikely (start > env.argStack.get_count ()))
     {
       env.set_error ();
       return;
     }
-    /* copy the blend values into blend array of the default values */
-    unsigned int start = env.argStack.get_count () - ((k+1) * n);
     for (unsigned int i = 0; i < n; i++)
-      env.argStack[start + i].set_blends (n, i, k, &env.argStack[start + n + (i * k)]);
+    {
+      const hb_array_t<const BlendArg>	blends = env.argStack.get_subarray (start + n + (i * k));
+      env.argStack[start + i].set_blends (n, i, k, blends);
+    }
 
     /* pop off blend values leaving default values now adorned with blend values */
     env.argStack.pop (k * n);