harfbuzz

Commit Graph

Author	SHA1	Message	Date
Garret Rieger	067f90a820	[subset] Fix for fuzzer timeout. Fixes https://oss-fuzz.com/testcase-detail/5549945449480192 In prune_langsys: move LangSys visited check up before any work is done for a LangSys. In this particular case the compare() method is responsible for the majority of the time spent and wasn't being guarded with a visisted check.	3 years ago
Garret Rieger	c4573c2ec7	[repacker] don't infinite loop if visited or roots is in error. Fixes https://oss-fuzz.com/testcase-detail/5205038086094848	3 years ago
Khaled Hosny	69d8f27c69	[meson] Require 0.55.0 We implicitly require it for building ragel subproject. This new version requirement should satisfied in both Fedora 33 and Debian bullseye, and not be too cutting edge for us.	3 years ago
Garret Rieger	ace98cc65f	[subset] Only sanitize recursion depth in COLR.	3 years ago
Garret Rieger	f51b48c8e7	[subset] Fix fuzzer found memory leak. Happens because an insert into a map with an invalid key reports successful, but this causes the set being inserted to be lost.	3 years ago
Qunxin Liu	0a7563a53f	[subset] fuzzer fix: https://oss-fuzz.com/testcase?key=6254792024915968 Make sure input is valid, each gid has a corresponding offset value in the map	3 years ago
Qunxin Liu	85deddb16e	[subset] fuzzer fix: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40406	3 years ago
Qunxin Liu	794b00db4b	[subset] fuzzer fix: https://oss-fuzz.com/testcase-detail/6616166961905664	3 years ago
Garret Rieger	74f96d9d4b	[repacker] fix heap use after free in repacker. Don't store a reference to the link in overflow records as the link object may be freed if the sorted graph vector is resized.	3 years ago
Garret Rieger	fb07f8f876	During subset input creation check for set alloc failures and fail if encountered.	3 years ago
Garret Rieger	dc31920bbe	Don't serialize null offsets in CPAL. Fixes https://oss-fuzz.com/testcase-detail/5443213648330752	3 years ago
Garret Rieger	c0f3af91b8	[subset] speed up add_gid_and_children and adjust op limit. Fix for fuzzer timeout: https://oss-fuzz.com/testcase-detail/5001604901240832. - Operation limit is per glyph, so 100,000 should still be far more than needed. - Switches from for(...) to while(...) loop for iteration. for(...) calls it.end() which in this case triggers a complete iteration. - Cache CompositeGlyph size in the iterator to avoid needing to recalculate it.	3 years ago
Garret Rieger	c08f1b8903	[map] fix incorrect population count in hash map. If the same key was set twice the population was being incorrectly incremented.	3 years ago
Garret Rieger	8c0c217b5a	[subset] fail reference blob in face builder if allocation for table sorting fails. Fixes https://oss-fuzz.com/testcase-detail/5041767803125760	3 years ago
Behdad Esfahbod	5086e10538	[test] Add failing fuzzer test case From https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36236 https://oss-fuzz.com/testcase-detail/5061207689134080	3 years ago
Garret Rieger	f9d8e4a976	[subset] switch ..._set_flags to not take a mask.	3 years ago
Garret Rieger	3d534b146c	[subset] convert subset input flags into bit flags. Store the flags in a bit set. Updates the public api to work with the bit set directly.	3 years ago
Behdad Esfahbod	0ded6a70c8	[subset] Fix another fuzzer issue Addition could overflow on 32bit arch. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36636 Fixes https://oss-fuzz.com/testcase-detail/5072358514753536	3 years ago
Garret Rieger	09474d8d7b	[subset] Fix fuzzer timeout in add_gid_and_children. The composite glyph graph isn't check for max operations by sanitize so track an operations count during the graph traversal.	3 years ago
Behdad Esfahbod	c68a00b92e	[subset] Fix possible overflows in VarRegionList serialize Fixes https://oss-fuzz.com/testcase-detail/5362189182566400	3 years ago
Garret Rieger	9ab751ac9f	[subset] Remove hb_subset(). Leaving just hb_subset_or_fail().	3 years ago
Garret Rieger	942636ae13	[subset] Remove hb_subset_input_get/set_retain_gids.	3 years ago
Garret Rieger	8bf5d4d4f7	[subset] Remove hb_subset_input_get/set_drop_hints.	3 years ago
Qunxin Liu	7416faceeb	[subset] fuzzer fix: https://oss-fuzz.com/testcase-detail/5715464591376384	3 years ago
Garret Rieger	bc06af977f	[subset] speed up feature collection when tags are specified. Precompute a feature index filter to avoid needing to iterate the feature tag list for each encountered feature index. For this particular fuzzer case speeds up feature collection from 50s to 2s.	3 years ago
Garret Rieger	675ebbeb3a	[subset] don't alloc zero bytes. It will be leaked later since hb_blob_create() won't set up the blob to cleanup since it has length zero.	3 years ago
Behdad Esfahbod	bdfed8f113	[blob] Add failing versions of create API Fixes https://github.com/harfbuzz/harfbuzz/issues/2567 New API: +hb_blob_create_or_fail() +hb_blob_create_from_file_or_fail() Use these in util/ to distinguish empty file from not-found file. Only err on the latter.	3 years ago
Qunxin Liu	35d6af6943	[subset] fix fuzzer testcase: https://oss-fuzz.com/testcase-detail/5965777994907648	3 years ago
Qunxin Liu	1b6008ca62	fix fuzzer testcase: https://oss-fuzz.com/testcase-detail/5417934246772736	3 years ago
Qunxin Liu	7ab0f4eda9	fuzzer fix	4 years ago
Garret Rieger	425ba1f4ab	[subset] fixes infinite loop in hb_set_get_max(). Fixes https://oss-fuzz.com/testcase-detail/5363902507515904	4 years ago
Garret Rieger	ec4321068b	[subset] fix infinite loop caused by alloc failure in repacker. Fixes: https://oss-fuzz.com/testcase-detail/5609112151916544.	4 years ago
Garret Rieger	0e845d973e	[subset] fix memory leak in repacker caused by failed alloc. Fixes: https://oss-fuzz.com/testcase-detail/5616763250278400.	4 years ago
Garret Rieger	3fb62cdc14	[subset] fail on offset overflow in tables that we don't repack. Fixes: https://oss-fuzz.com/testcase-detail/5229304507138048	4 years ago
Qunxin Liu	9dc9f0385d	[subset] fix for fuzzer testcase: https://oss-fuzz.com/testcase-detail/5858518134554624	4 years ago
Qunxin Liu	4af5dacedc	[subset] add fuzzer testcase	4 years ago
Garret Rieger	64122b5a44	[subset] don't visit lookup if covered glyph set has failed. If covered glyph set is in error then the same lookup can be recursed into repeatedly potentially causing a fuzzer timeout. Fixes: https://oss-fuzz.com/testcase-detail/5416421032067072.	4 years ago
Garret Rieger	71d6d15600	[subset] clamp distance to prevent shifting outside of the limits of int64. Fixes https://oss-fuzz.com/testcase-detail/4961171477233664.	4 years ago
Garret Rieger	c5c13006a1	[subset] fix memory leaks found in https://oss-fuzz.com/testcase-detail/5179935334465536	4 years ago
Garret Rieger	adca4ce071	[subset] fixes https://oss-fuzz.com/testcase-detail/6173520787800064 . Caused by incorrect bounds check in glyph closure for context lookups.	4 years ago
Garret Rieger	752e393ad2	[subset] avoid calling clear on null pool set.	4 years ago
Garret Rieger	8741914a80	[subset] fix memory leak when map insert fails.	4 years ago
Garret Rieger	5b6da6d2f0	[subset] add fuzzer test case.	4 years ago
Garret Rieger	a804a0c903	[subset] add fuzzer test case.	4 years ago
Khaled Hosny	f2d08578e7	[tests] Increase shape-fuzzer timeout	4 years ago
Garret Rieger	5ca353a2d0	[subset] fix heap buffer overflow found by fuzzer.	4 years ago
Behdad Esfahbod	33a0f0b686	[test] Remove fuzzed test font that triggers virus alert Fixes https://github.com/harfbuzz/harfbuzz/issues/2750	4 years ago
Garret Rieger	f94bf9f06f	[set fuzzer] limit the total number of set members in a fuzzing input. Currently the fuzzer can create arbitarily long inputs which once big enough will trigger a timeout.	4 years ago
Garret Rieger	a4c3732f59	[ENOMEM] fix set clear() causing corruption if the set is in_error().	4 years ago
Khaled Hosny	5091ea7e24	Merge pull request #2733 from astiob/buffer-context-doc [docs] Describe buffer context applicability more explicitly	4 years ago

50 Commits (52f5711ed0354b0c5d396255886f03048997bbd9)