diff --git a/src/hb-repacker.hh b/src/hb-repacker.hh index 35e3566e5..295dc6415 100644 --- a/src/hb-repacker.hh +++ b/src/hb-repacker.hh @@ -147,7 +147,8 @@ struct graph_t } vertex_t* v = vertices_.push (); - v->obj = *objects[i]; + if (check_success (!vertices_.in_error ())) + v->obj = *objects[i]; if (!removed_nil) continue; for (unsigned i = 0; i < v->obj.links.length; i++) // Fix indices to account for removed nil object. diff --git a/src/hb-vector.hh b/src/hb-vector.hh index 13517a9c2..17f7d486f 100644 --- a/src/hb-vector.hh +++ b/src/hb-vector.hh @@ -177,6 +177,11 @@ struct hb_vector_t Type *push (T&& v) { Type *p = push (); + if (p == &Crap (Type)) + // If push failed to allocate then don't copy v, since this may cause + // the created copy to leak memory since we won't have stored a + // reference to it. + return p; *p = hb_forward (v); return p; } diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5179935334465536 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5179935334465536 new file mode 100644 index 000000000..61e7fa179 Binary files /dev/null and b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5179935334465536 differ