[subset] fix heap buffer overflow found by fuzzer.

4 years ago · 5ca353a2d0
parent ae860db893
commit 5ca353a2d0
3 changed files with 3 additions and 0 deletions
--- a/src/hb-ot-layout-gpos-table.hh
+++ b/src/hb-ot-layout-gpos-table.hh
@ -2064,6 +2064,9 @@ struct LigatureArray : OffsetListOf<LigatureAttach>
    unsigned ligature_count = 0;
    for (hb_codepoint_t gid : coverage)
    {
+      if (ligature_count >= this->len)
+        break;
+
      ligature_count++;
      if (!glyphset.has (gid)) continue;

--- a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4901143794810880
+++ b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4901143794810880
--- a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-6372147008241664
+++ b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-6372147008241664