bdf372b24c
[subset/cbdt] Release the referenced cbdt table on error
...
Just accidentally spotted it, when the table has less than 4 bytes
5 years ago
0d729b4b72
[avar] Fix out-of-bound read when input is bigger than all the coords
...
'i' shouldn't become equal to array's length which as the increament
is happened at end of the loop, if the input is bigger than all the
table coords, it will be equal to array's length.
Fixes https://crbug.com/oss-fuzz/21092
5 years ago
6924e29f62
[var] Fix hb_ot_var_get_axis_infos's offset semantic
...
The API was adding offset to input's infos buffer index also which is
unusual between our APIs and wrong.
5 years ago
b7617f6b3c
[glyf] Update to latests of ttf-parser
5 years ago
0b29053864
removed unused code
5 years ago
e8f010d793
removed unused code & data; rename
5 years ago
14a7b6f1ab
Set hb_buffer_t to use array_t.reverse().
5 years ago
5935a1dc0b
add pop_discard() calls to errror returns
5 years ago
c05458ec7f
update cff & cff2 subsetters
5 years ago
446d1e3bbc
[fuzz] Add more of fixed cases
5 years ago
9004848560
[gvar] Make sure font's num_coords matches with gvar.axisCount
5 years ago
1af3363f9e
[gvar] Use hb_array_t instead indexing raw pointers
5 years ago
99b5b3f1b1
[gvar] Make sure TupleVarHeader has the needed size
...
Fixes https://crbug.com/oss-fuzz/21026
5 years ago
b398748d8b
[algs] Add hb_clamp
...
Similar to stl and glsl's clamp
5 years ago
558f922788
[fuzz] Avoid empty memcpy and ubsan complain by length checking before memcpy
5 years ago
6543d166fd
[fuzz] Remove the not yet fixed timeout, going to investigate
5 years ago
2bbf1c8673
[fuzz] Add more of supposed to already be fixed cases from Chromium bug tracker
5 years ago
f745777c60
minor, debug bit, ops
5 years ago
f253f06cf3
[fuzz] Add another fixed case
...
https://crbug.com/oss-fuzz/14626
another numerous subtables count which is fixed by d38360397
5 years ago
d383603976
Limit OT::Lookup subtables ( #2219 )
...
Fixes https://crbug.com/oss-fuzz/13943
5 years ago
29efd964f2
[fuzz] Add cases that marked as wontfix
...
Let's see if they were really false alarms, if so, let's just have them.
5 years ago
60262e4ca9
[var] Build end-points array on gvar itself
5 years ago
cb65150fec
[draw] minor
5 years ago
44169f3396
[draw] Fix invalid rendering of some glyph on Estedad-VF
...
Basically reverts 11f3fcaFixes #2215
5 years ago
86c40b3a1d
[fuzz/draw] Call _get_glyph_extents
...
Other render related APIs also may be added also later such
as ot-color and future rendering things.
5 years ago
5ab50eebd7
collect_unicodes() with clamp, calling add_range()
...
Use add_range instead an inner loop, clamp its input number by
number of glyphs a face has.
Even the face cmap12 and 13 have 32-bit hb_codepoint_t, which is here
used to make timeout, face's maxp has 16-bit gid limitation at least for now,
using that makes sure we both fix and the timeout and don't need to change
much things here also in order to support 32-bit gids also someday.
Fixes #2204
5 years ago
414529e45a
[subset] Limit the number of feature indices processed during script subsetting.
5 years ago
75622b0d24
[subset] Limit the number of features processed in the feature closure.
5 years ago
410b4881d0
[subset] Add fuzzer timeout testcase.
5 years ago
c66ee213b7
Limit the number of feature indices processed during feature collection.
5 years ago
e57ced5fc0
[gvar] Add other possibly fixed fuzzer case
...
Speculatively should've been fixed by 61208401https://crbug.com/oss-fuzz/20924 related
5 years ago
758fda728b
[glyf] Don't accept gids higher than maxp's glyphs number
...
This specially becomes concerning on sub-components where a gvar table
that is sanitized using maxp's glyphs number overflows when a high gid
accepted here goes to it, maybe an additional check can be put there
also, this however feels to be enough.
Fixes https://crbug.com/oss-fuzz/20944
5 years ago
e642aab116
[subset] Add source_blob as a hb_subset_context_t field ( #2203 )
...
So no more double sanitizing source table.
5 years ago
e90213868b
Revert "collect_unicodes() to check gid < num_glyphs with cmap 12"
...
Didn't fix the case actually, making bots to fail.
This reverts commit 15b43a4104
5 years ago
61208401f4
[gvar] Use hb_bytes_t.check_range instead having in house one
...
And use TupleVarHeader calculated size for validity check.
Fixes https://crbug.com/oss-fuzz/20919 and possibly other gvar related issues
5 years ago
15b43a4104
collect_unicodes() to check gid < num_glyphs with cmap 12
...
fixes #2204
5 years ago
868ecf7b26
[draw] Add fuzzer runner
5 years ago
b0749bfaa5
[subset] GDEF LigCaretList subsetting support
5 years ago
002f0e20c4
reimplment serialize_int using check_assign()
5 years ago
14b134379d
[gvar] Minor, check whether sub_array result also have enough room
5 years ago
8eba66c1c6
[gvar] Fix invalid memory access by refactoring GlyphVarData fetch logic
...
Fixes https://crbug.com/oss-fuzz/20906
5 years ago
f44e1dc07d
Fix spelling.
5 years ago
5ad761b943
[subset] GDEF MarkGlyphSets subsetting support
5 years ago
fcd7f33bbb
[subset] GDEF glyphClassDef subsetting support
...
glyphClassDef uses the same ClassDef format. However, glyphClassDef table
uses predefined class values so we do not remap class values.
5 years ago
50129b03a1
Add a reverse () call to hb_array_t.
5 years ago
38c6598c1c
Switch to C style comments.
5 years ago
52b6e0baa0
When serializing cmap14 order the offsets from smallest to largest.
...
Current versions of OTS fail fonts with cmap 14's who's last offset does not point to the a block at the end of the table.
5 years ago
a99134c5be
add oss-fuzz 20886 test file
5 years ago
d0aaba5c50
fixes oss-fuzz 20886
...
hb_set_t::resize () is needed after compact()
5 years ago
05a25c1a5b
[cff] minor, remove unused fields
5 years ago
Ebrahim Byagowi
ariza
Garret Rieger
Qunxin Liu
Evgeniy Reizner