b8c7c0a0e6
[fuzzer] In 50% of runs don't fail the allocator
2 years ago
311413f16b
[subset] Fix fuzzer issue.
...
Fixes https://oss-fuzz.com/testcase-detail/5693568490012672 . new_index should be set from new_index2 when the entry is present in the map.
2 years ago
62e803b361
[sbix] Limit glyph extents
...
Fixes https://github.com/harfbuzz/harfbuzz/issues/3557
2 years ago
5a058ba158
[shape-fuzzer] Add commented out more buffer-verify option
...
Those currently fail and I've been unable to debug them.
I tried two, passing them to hb-shape doesn't reproduce the failure. :(
2 years ago
189f65344a
[fuzz-shape] Verify shape output
...
Let the fuzzers loose on shape verify.
2 years ago
8f9f0c494b
[subset] Enforce cmap12 group ordering constraints in collect_mapping.
...
Fixes fuzzer issue: https://oss-fuzz.com/testcase-detail/6365271012540416
3 years ago
b051f3fa83
[subset] Fix cpal subsetting when there are partial palette overlaps.
...
The existing code doesn't correctly handle the case where palettes partially overlap in the color record array. This changes the subsetting to only share entries in the color record array when palettes have the same first color index. Partially overlapping palettes will be converted to disjoint segments in the color record array.
Updates one of the color tests to use multiple palettes.
Also fixes fuzzer: https://oss-fuzz.com/testcase-detail/5568200165687296 .
3 years ago
ca8a0f3ea3
[gvar] Protect against out-of-range access
...
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47281
Fixes https://oss-fuzz.com/testcase-detail/5508865908670464
3 years ago
a665e29ed7
[use] Avoid O(n^2) in the machine
...
Fixes https://github.com/harfbuzz/harfbuzz/issues/3502
3 years ago
03085132ba
[buffer] Fix out-buffer under memory-alloc failure
...
This was broken in July refactoring of the buffer, and exposed to
ReverseChainSingleSubstFormat1 in 3807061d63https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38800
https://bugs.chromium.org/p/chromium/issues/detail?id=1303552
3 years ago
151f205819
[draw] Emit move_to immediately, like other operators
3 years ago
f1a9a9ccaf
[draw-state] Pass state down to callbacks
3 years ago
1740916ede
[draw] Remove check for no-op
...
This is unnecessary overhead. Up to rasterizers to handle this. Plus,
this throws off point-numbers in uses that rely on it.
Disabled one test that broke with this.
3 years ago
8b4f429000
[draw] Virtualize hb_font_draw_glyph() into hb_font_get_glyph_shape()
...
To be implemented in hb-ft.
3 years ago
2bed4f46fb
[draw] Fix draw signatures
3 years ago
08e1096609
[draw-fuzzer] Fix signatures
3 years ago
e0ac6c587b
Remove remaining traces of HB_EXPERIMENTAL_API
3 years ago
af407dd24d
Add a fuzzer font
3 years ago
4e2f409bce
[subset] Don't hold references to members of the active_glyph_stack.
...
These references may get invalidated after the vector for the stack is resized. Fixes: https://oss-fuzz.com/testcase-detail/5422577634377728
3 years ago
61856359cb
[fuzz] Disable verification for now.
3 years ago
6596e42d16
[fuzz] Verify shape results
3 years ago
e2e305066a
Fix various typos
...
Found via `codespell -q 3 -S ./perf/texts -L actualy,ba,beng,fo,gir,inout,nd,ot,pres,ro,te,teh,timne`
3 years ago
87496bf63e
[subset] fix fuzzer timeout if visisted_paint goes into error.
3 years ago
067f90a820
[subset] Fix for fuzzer timeout.
...
Fixes https://oss-fuzz.com/testcase-detail/5549945449480192
In prune_langsys: move LangSys visited check up before any work is done for a LangSys. In this particular case the compare() method is responsible for the majority of the time spent and wasn't being guarded with a visisted check.
3 years ago
c4573c2ec7
[repacker] don't infinite loop if visited or roots is in error.
...
Fixes https://oss-fuzz.com/testcase-detail/5205038086094848
3 years ago
69d8f27c69
[meson] Require 0.55.0
...
We implicitly require it for building ragel subproject. This new version
requirement should satisfied in both Fedora 33 and Debian bullseye, and
not be too cutting edge for us.
3 years ago
ace98cc65f
[subset] Only sanitize recursion depth in COLR.
3 years ago
f51b48c8e7
[subset] Fix fuzzer found memory leak.
...
Happens because an insert into a map with an invalid key reports successful, but this causes the set being inserted to be lost.
3 years ago
0a7563a53f
[subset] fuzzer fix: https://oss-fuzz.com/testcase?key=6254792024915968
...
Make sure input is valid, each gid has a corresponding offset value in
the map
3 years ago
85deddb16e
[subset] fuzzer fix: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40406
3 years ago
794b00db4b
[subset] fuzzer fix: https://oss-fuzz.com/testcase-detail/6616166961905664
3 years ago
74f96d9d4b
[repacker] fix heap use after free in repacker.
...
Don't store a reference to the link in overflow records as the link object may be freed if the sorted graph vector is resized.
3 years ago
fb07f8f876
During subset input creation check for set alloc failures and fail if encountered.
3 years ago
dc31920bbe
Don't serialize null offsets in CPAL.
...
Fixes https://oss-fuzz.com/testcase-detail/5443213648330752
3 years ago
c0f3af91b8
[subset] speed up add_gid_and_children and adjust op limit.
...
Fix for fuzzer timeout: https://oss-fuzz.com/testcase-detail/5001604901240832 .
- Operation limit is per glyph, so 100,000 should still be far more than needed.
- Switches from for(...) to while(...) loop for iteration. for(...) calls it.end() which in this case triggers a complete iteration.
- Cache CompositeGlyph size in the iterator to avoid needing to recalculate it.
3 years ago
c08f1b8903
[map] fix incorrect population count in hash map.
...
If the same key was set twice the population was being incorrectly incremented.
3 years ago
8c0c217b5a
[subset] fail reference blob in face builder if allocation for table sorting fails.
...
Fixes https://oss-fuzz.com/testcase-detail/5041767803125760
3 years ago
5086e10538
[test] Add failing fuzzer test case
...
From https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36236
https://oss-fuzz.com/testcase-detail/5061207689134080
3 years ago
f9d8e4a976
[subset] switch ..._set_flags to not take a mask.
3 years ago
3d534b146c
[subset] convert subset input flags into bit flags.
...
Store the flags in a bit set. Updates the public api to work with the bit set directly.
3 years ago
0ded6a70c8
[subset] Fix another fuzzer issue
...
Addition could overflow on 32bit arch.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36636
Fixes https://oss-fuzz.com/testcase-detail/5072358514753536
3 years ago
09474d8d7b
[subset] Fix fuzzer timeout in add_gid_and_children.
...
The composite glyph graph isn't check for max operations by sanitize so track an operations count during the graph traversal.
3 years ago
c68a00b92e
[subset] Fix possible overflows in VarRegionList serialize
...
Fixes https://oss-fuzz.com/testcase-detail/5362189182566400
3 years ago
9ab751ac9f
[subset] Remove hb_subset(). Leaving just hb_subset_or_fail().
3 years ago
942636ae13
[subset] Remove hb_subset_input_get/set_retain_gids.
3 years ago
8bf5d4d4f7
[subset] Remove hb_subset_input_get/set_drop_hints.
3 years ago
7416faceeb
[subset] fuzzer fix: https://oss-fuzz.com/testcase-detail/5715464591376384
3 years ago
bc06af977f
[subset] speed up feature collection when tags are specified.
...
Precompute a feature index filter to avoid needing to iterate the feature tag list for each encountered feature index. For this particular fuzzer case speeds up feature collection from 50s to 2s.
3 years ago
675ebbeb3a
[subset] don't alloc zero bytes.
...
It will be leaked later since hb_blob_create() won't set up the blob to cleanup since it has length zero.
3 years ago
bdfed8f113
[blob] Add failing versions of create API
...
Fixes https://github.com/harfbuzz/harfbuzz/issues/2567
New API:
+hb_blob_create_or_fail()
+hb_blob_create_from_file_or_fail()
Use these in util/ to distinguish empty file from not-found file.
Only err on the latter.
3 years ago
Behdad Esfahbod
Garret Rieger
luz paz
Khaled Hosny
Qunxin Liu