7dc341fe74
[subset] Fix UBSAN issue in sbix
5 years ago
1ab3924b31
refix PR #2087 subset PairPos1
...
also added oss-fuzz 20211 data fixed by this
5 years ago
b18cb5b5ee
Add second fixed test
5 years ago
8614a30bc9
[subset] Fix sbix fuzz problem
5 years ago
6bcf57eaa3
Simplify copy and add fuzzing coverage
5 years ago
dc03a993d0
Fix collect lookups logic of FeatureTableSubstitution ( #2097 )
...
https://crbug.com/oss-fuzz/20036
5 years ago
a32ecc15ae
Fix collect lookups logic of FeatureVariationRecord
...
As "Offset to a feature table substitution table, from beginning of the FeatureVariations table."
from https://docs.microsoft.com/en-us/typography/opentype/spec/chapter2 the record should
match its sanitize logic not the reverse way.
Fixes https://crbug.com/oss-fuzz/20021 and https://crbug.com/oss-fuzz/20022
5 years ago
d2ab1ec65b
fixes oss-fuzz 19978: Null-dereference READ ( #2091 )
5 years ago
257a197ae7
Fail serialize when map has incorrect value
...
fixes https://crbug.com/oss-fuzz/19956
am not super happy with the fix, guess we should do some check
before the memcpy anyway as @blueshade7 thinks also,
so let's have it or revert it when we have a better approach for the case.
5 years ago
8ed46c3678
[fuzz] minor, add another already fixed case
...
https://crbug.com/oss-fuzz/19907
5 years ago
341407f7a5
[fuzz] minor, upload another fixed case
...
https://crbug.com/oss-fuzz/19878
5 years ago
7950beecfc
[subset] Fix null pointer dereference in hvar/vvar subset ( #2085 )
...
Rest of the code assumes there is at least one subtable, lets return here if not.
* https://crbug.com/oss-fuzz/19827
* https://crbug.com/oss-fuzz/19847
5 years ago
64a45be519
[ubsan] Don't decrease pointer if match_glyph_data is null ( #2048 )
...
Similar to fix on https://github.com/harfbuzz/harfbuzz/pull/2022
Fixes https://crbug.com/1023070
5 years ago
84b86a12d9
[fuzz] Remove just added case
...
It didn't fail locally but on bots causing timeout, let remove for now.
5 years ago
a8f049c9a1
[fuzz] Upload testcase of https://crbug.com/oss-fuzz/18529
...
Apparently false alarm per last comment and was ok locally also but lets have it here also
5 years ago
defe9b6da0
crash fix : Heap-buffer-overflow READ 2
...
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18513
5 years ago
b2fcca6e14
fuzzer crash fix
...
https://oss-fuzz.com/testcase-detail/5643107869917184
5 years ago
9815ca0338
[ci] Use custom subset fuzzer timeout for failing sanitizer bots
5 years ago
95ab110cd9
Optimize intersects_array to fix fuzzer timeout.
5 years ago
b33a0d628e
fuzzer crash fix: Null-dereference WRITE
...
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18363
5 years ago
e766783152
[fuzz] Add https://crbug.com/oss-fuzz/17898 testcase
5 years ago
831daf4c76
Enforce HB_MAX_LANGSYS limit during layout subsetting.
5 years ago
0665dce116
[fuzzer] Don't process output in debug mode as it causes timeout
6 years ago
d3b984d379
Revert in-house pow10 ( d80a3ea) and fix oss-fuzz/16922
...
Probably can be fixed but merging it was wrong so let's revert.
6 years ago
875985cd48
[subset] Don't allow malicious fonts to insert unlimited table headers
...
Fixes https://crbug.com/oss-fuzz/16810
6 years ago
269a120f13
[subset] Raise the bar in new vs old table size
...
https://crbug.com/oss-fuzz/16740
This is actually an interesting thing that {h,v}mtx allocates as
much as a font pretends to have glyphs but the solution is not
that obvious as regular fonts can have less than actually containing
metrics in their {h,v}mtx. This change raises the bar to consider this
hmtx 4 byte for every glyph case.
Initially we wanted to just find things allocating crazy amount of
memory but having the assert has led to interesting findings also
so let's don't remove the assert and see what we can find elsewhere.
6 years ago
28aba780c4
[subset] Fix blob leak of _subset2 when returns early
...
Fixes https://crbug.com/oss-fuzz/16639
6 years ago
b31d627f15
Increase subset fuzzer timeout to 16s
...
To satisfy -valgrind and -tsan bots, very ugly
6 years ago
e21bdf500d
Increase subset fuzzer timeout to 8s
...
Probably we should just remove timeout when running tsan and vaglrind here, the flaky bots
6 years ago
bdfdac0f26
[ci][fuzzer] print valgrind failure if an error happened
6 years ago
f8242b61ab
[fuzz] Increase subset runner timeout for tsan bot
...
Now is flaky let's just increase and maybe investigate later
6 years ago
b65bad18aa
[fuzz] Don't fail when blob is empty
...
And enable more tests able to trig the issue.
6 years ago
c85f624b51
Force blob generation and memory check in hb-subset-fuzzer
6 years ago
8341c0b304
add test case file
6 years ago
90872a29ee
change assert(false) to failure
6 years ago
65e66a2d37
added test data
6 years ago
5846884f86
test: Use nullptr in C++ code. ( #1744 )
6 years ago
e1a5ce6aa6
Fix fuzzer crash testcase
...
Add a check for stringOffSet(uint16) overflow,
return early if overflow happens
6 years ago
0ff3618c2d
[subset] Use hb_subset_input_t inside of subset_options_t so that input defaults are shared between the library and cli.
6 years ago
9ef241cd40
[test] Add one more
6 years ago
3efb7af7e2
[STAT] Fix sanitize condition
...
Oops!
Fixes https://oss-fuzz.com/testcase-detail/5696825891225600
6 years ago
30c059a978
[test] minor, fix -Weverything bot
6 years ago
25531a3039
[test] minor
...
style fix and add return statement
6 years ago
25a5b287f2
Fix sanitize fail of extension sublookups
...
Fixes https://bugs.chromium.org/p/chromium/issues/detail?id=960331
6 years ago
df237d2fe7
[test] Add https://crbug.com/oss-fuzz/14641 testcase
...
As 503748d
6 years ago
6d6edc8b25
[valgrind] Use libtool and support run-subset-fuzzer-tests ( #1668 )
6 years ago
62c6e17072
[test] Add crbug.com/oss-fuzz/14474 testcase
...
Fixed at 6977a95f
6 years ago
ba0386060d
fix oss-fuzz issue 14345
6 years ago
b7384c89e2
[fuzzing] Run valgrind with --leak-check=full
6 years ago
3ff66c0029
[fuzzing] Fail if valgrind is requested but not found
6 years ago
ckitagawa
ariza
Ebrahim Byagowi
Qunxin Liu
Garret Rieger
Michiharu Ariza
Bruce Mitchener
Behdad Esfahbod