src/Makefile.am | 2 +-
src/hb-ot-shape-fallback.cc | 11 ++++++-----
2 files changed, 7 insertions(+), 6 deletions(-)
New commits:
commit b220b5a44425db387b2149c4904a43ab369a2d6a
Author: Behdad Esfahbod <beh...@behdad.org>
Date: Thu Feb 8 17:14:52 2018 -0600
Avoid undefined-behavior in fallback mark positioning
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5584
diff --git a/src/hb-ot-shape-fallback.cc b/src/hb-ot-shape-fallback.cc
index 6b228790..0e5b20f1 100644
--- a/src/hb-ot-shape-fallback.cc
+++ b/src/hb-ot-shape-fallback.cc
@@ -200,8 +200,7 @@ position_mark (const hb_ot_shape_plan_t *plan,
unsigned int combining_class)
{
hb_glyph_extents_t mark_extents;
- if (!font->get_glyph_extents (buffer->info[i].codepoint,
- &mark_extents))
+ if (!font->get_glyph_extents (buffer->info[i].codepoint, &mark_extents))
return;
hb_position_t y_gap = font->y_scale / 16;
@@ -322,7 +321,9 @@ position_around_base (const hb_ot_shape_plan_t *plan,
base_extents.y_bearing += buffer->pos[base].y_offset;
unsigned int lig_id = _hb_glyph_info_get_lig_id (&buffer->info[base]);
- unsigned int num_lig_components = _hb_glyph_info_get_lig_num_comps
(&buffer->info[base]);
+ /* Use integer for num_lig_components such that it doesn't convert to
unsigned
+ * when we divide or multiply by it. */
+ int num_lig_components = _hb_glyph_info_get_lig_num_comps
(&buffer->info[base]);
hb_position_t x_offset = 0, y_offset = 0;
if (HB_DIRECTION_IS_FORWARD (buffer->props.direction)) {
@@ -331,7 +332,7 @@ position_around_base (const hb_ot_shape_plan_t *plan,
}
hb_glyph_extents_t component_extents = base_extents;
- unsigned int last_lig_component = (unsigned int) -1;
+ int last_lig_component = -1;
unsigned int last_combining_class = 255;
hb_glyph_extents_t cluster_extents = base_extents; /* Initialization is just
to shut gcc up. */
hb_glyph_info_t *info = buffer->info;
@@ -340,7 +341,7 @@ position_around_base (const hb_ot_shape_plan_t *plan,
{
if (num_lig_components > 1) {
unsigned int this_lig_id = _hb_glyph_info_get_lig_id (&info[i]);
- unsigned int this_lig_component = _hb_glyph_info_get_lig_comp
(&info[i]) - 1;
+ int this_lig_component = _hb_glyph_info_get_lig_comp (&info[i]) - 1;
/* Conditions for attaching to the last component. */
if (!lig_id || lig_id != this_lig_id || this_lig_component >=
num_lig_components)
this_lig_component = num_lig_components - 1;
commit 3b68a03a1c5a23adbc73f4508009dd5b72bc9d81
Author: Behdad Esfahbod <beh...@behdad.org>
Date: Thu Feb 8 17:00:37 2018 -0600
[fuzzer] Minor
diff --git a/src/Makefile.am b/src/Makefile.am
index e450ea73..500730d4 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -159,7 +159,7 @@ EXTRA_LTLIBRARIES = libharfbuzz-fuzzing.la
libharfbuzz_fuzzing_la_LINK = $(libharfbuzz_la_LINK)
libharfbuzz_fuzzing_la_SOURCES = $(libharfbuzz_la_SOURCES)
libharfbuzz_fuzzing_la_CPPFLAGS = $(libharfbuzz_la_CPPFLAGS)
$(FUZZING_CPPFLAGS)
-libharfbuzz_fuzzing_la_LDFLAGS = $(libharfbuzz_la_LDFLAGS)
+libharfbuzz_fuzzing_la_LDFLAGS = $(AM_LDFLAGS)
libharfbuzz_fuzzing_la_LIBADD = $(libharfbuzz_la_LIBADD)
EXTRA_libharfbuzz_fuzzing_la_DEPENDENCIES =
$(EXTRA_libharfbuzz_la_DEPENDENCIES)
CLEANFILES += libharfbuzz-fuzzing.la
_______________________________________________
HarfBuzz mailing list
HarfBuzz@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/harfbuzz
