From df698f3299d92867e3305715f675b2621c316acd Mon Sep 17 00:00:00 2001 From: Behdad Esfahbod Date: Tue, 3 Nov 2015 12:15:12 -0800 Subject: [PATCH] [ot-font] Fix hmtx table length checking, *again* Exactly the same problem that I fixed in 63ef0b41dc48d6112d1918c1b1de9de8ea90adb5 I rewrote the table checking yesterday in 67f8821fb25d9bd55719f5e29a582ae1af4b02b3 and introduced the exact same issue again. :( Good thing we have ongoing fuzzing going now. Was discovered immediately by libFuzzer. Thanks kcc! https://github.com/behdad/harfbuzz/issues/139#issuecomment-153449473 Fixes https://github.com/behdad/harfbuzz/issues/156 --- src/hb-ot-font.cc | 4 ++-- .../sha1sum/8240789f6d12d4cfc4b5e8e6f246c3701bcf861f.ttf | Bin 0 -> 633 bytes test/shaping/fonts/sha1sum/MANIFEST | 1 + test/shaping/tests/fuzzed.tests | 1 + 4 files changed, 4 insertions(+), 2 deletions(-) create mode 100644 test/shaping/fonts/sha1sum/8240789f6d12d4cfc4b5e8e6f246c3701bcf861f.ttf diff --git a/src/hb-ot-font.cc b/src/hb-ot-font.cc index bde63fa..94c31b3 100644 --- a/src/hb-ot-font.cc +++ b/src/hb-ot-font.cc @@ -59,11 +59,11 @@ struct hb_ot_face_metrics_accelerator_t /* Cap num_metrics() and num_advances() based on table length. */ unsigned int len = hb_blob_get_length (this->blob); - if (unlikely (this->num_advances * 4 < len)) + if (unlikely (this->num_advances * 4 > len)) this->num_advances = len / 4; this->num_metrics = this->num_advances + (len - 4 * this->num_advances) / 2; - /* We MUSt set num_metrics to zero if num_advances is zero. + /* We MUST set num_metrics to zero if num_advances is zero. * Our get_advance() depends on that. */ if (unlikely (!this->num_advances)) { diff --git a/test/shaping/fonts/sha1sum/8240789f6d12d4cfc4b5e8e6f246c3701bcf861f.ttf b/test/shaping/fonts/sha1sum/8240789f6d12d4cfc4b5e8e6f246c3701bcf861f.ttf new file mode 100644 index 0000000000000000000000000000000000000000..8eed14d94e07b2eba586d9fe23c1846d88f078a9 GIT binary patch literal 633 zcmZuvOG_J36#njGLgHJA3u%Q}1Ya9p#Z?M|;;N9Lb)l;|j7p%42^cY}AV>*1g6+a? z6x`}BaMK?lwDcEr8E8Q?Gf+GI?nLoH&z-sF`_AK@bM8!Gaj}35cA(HRx3FL@Uw!-q zh~EI}g?HnxCT?=y$w{%|`ED7VxFA0vpDM1otM1Ra&%`IAz)X>b)EDuVoH@u9{Yq7y z5kXeDrG2+rhIEV}y(5CuPZ|-|Q{D@6KNXn&xMc zjT`c7QY8&}=VOj){AK04>PZhz@)*fJOuT{=pIQSxiTEGkxesE$9bW%9`7cc zgkn4@L4f%xl*jF~xMmkZw0m2dm6E?++Nc<6hc6Jml%Wa-2K7Pb>2~BqdF!(KTlPoq zakIS-S_rAMHR*X~D6!8ZUfjs3=