From 14f9852c0d6ae99c2881a28b4e5944a22c8587a7 Mon Sep 17 00:00:00 2001 From: Behdad Esfahbod Date: Mon, 6 Feb 2023 14:51:25 -0700 Subject: [PATCH] [Tizen] [GPOS] Avoid O(n^2) behavior in mark-attachment Better implementation; avoids arbitrary limit on look-back. [CVE-2023-25193] hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. https://nvd.nist.gov/vuln/detail/CVE-2023-25193 Change-Id: I778490c8c94aae046e38cb07f04753cbc26b8e6a --- src/hb-ot-layout-gsubgpos.hh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/hb-ot-layout-gsubgpos.hh b/src/hb-ot-layout-gsubgpos.hh index 65de131..d9a068c 100644 --- a/src/hb-ot-layout-gsubgpos.hh +++ b/src/hb-ot-layout-gsubgpos.hh @@ -641,6 +641,9 @@ struct hb_ot_apply_context_t : uint32_t random_state; + signed last_base = -1; // GPOS uses + unsigned last_base_until = 0; // GPOS uses + hb_ot_apply_context_t (unsigned int table_index_, hb_font_t *font_, hb_buffer_t *buffer_) : @@ -673,7 +676,7 @@ struct hb_ot_apply_context_t : iter_context.init (this, true); } - void set_lookup_mask (hb_mask_t mask) { lookup_mask = mask; init_iters (); } + void set_lookup_mask (hb_mask_t mask) { lookup_mask = mask; last_base = -1; last_base_until = 0; init_iters (); } void set_auto_zwj (bool auto_zwj_) { auto_zwj = auto_zwj_; init_iters (); } void set_auto_zwnj (bool auto_zwnj_) { auto_zwnj = auto_zwnj_; init_iters (); } void set_random (bool random_) { random = random_; } -- 2.7.4