From 71d6d1560035619ee685dc9aa626eeefabe5e9f1 Mon Sep 17 00:00:00 2001 From: Garret Rieger Date: Mon, 5 Apr 2021 12:03:17 -0700 Subject: [PATCH] [subset] clamp distance to prevent shifting outside of the limits of int64. Fixes https://oss-fuzz.com/testcase-detail/4961171477233664. --- src/hb-repacker.hh | 3 ++- ...-minimized-hb-subset-fuzzer-4961171477233664 | Bin 0 -> 39793 bytes 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4961171477233664 diff --git a/src/hb-repacker.hh b/src/hb-repacker.hh index 295dc6415..2cfff9b29 100644 --- a/src/hb-repacker.hh +++ b/src/hb-repacker.hh @@ -75,7 +75,8 @@ struct graph_t // setting distance = 0 which will force to sort immediately after // it's parent where possible. - int64_t modified_distance = distance + distance_modifier (); + int64_t modified_distance = + hb_min (hb_max(distance + distance_modifier (), 0), 0x7FFFFFFFFF); return (modified_distance << 24) | (0x00FFFFFF & order); } diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4961171477233664 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4961171477233664 new file mode 100644 index 0000000000000000000000000000000000000000..013a859434926b5bc0606ebb4a5c43c256177715 GIT binary patch literal 39793 zcmeHw2{@Ho`}f*=o5>uKDO1MGgpA3MF_g-Xc^)Gv^Bf|DP-IMoh-64)C^A$+p)y5O zC^FCcTU&Lm(|gYQzs~pl&wIXe-s@Ri`(E=}_qw08*8Z)vpPv8<0DunS8Np)l)%0`? z0PDm$OyQHsM6szE998a2L+!=IsfhrtBpwvJ&`0lsV%wpF-Ecnod+d7{gYyZ#r2*8h zYkp7r=D}K682VoMN7j$%Pd*lGVU+<`L*r@)LXBW)6#VzS5G&w>itPhpU_Vd*DnJA1 z0DW)_oP<4K0S&+aLO=#604-nu#vg~Ud_V|@18JZL4uQi!7Z?B|U<~j8Fx;+y0z{;+ z1MD8a4fscdfdr5NNXD>A0??@{bceI!llmwzUiT+u7i-@B4Tm6m{7e^nq z^8QKgN1MQs!f013Z;9VXNnv!5mD9HL{v9cbPPFot{FRgvM(103|5~#CNGXKrqUhTH zL5icF!`y!-CD9`=_g|&$_mutUIhgxzZ_96CC`B=J+mZ)L zag5A2dE!^$AL-J<7%eMr&TrmtiE z_1aqm+b~+AZAAqDK5TGb0tZmq1B5VO4G7>iTYzW3;N?TOxwCzHXNM{ff-TqzEGvV> z24bNP00~YQvH|OD9Rb{zNgM$YAb}e-5iE-HaV7%zzc?Zw4EJs_Kn->R6d@M71;doM zFm%G(Qx~8VVWThzCDZ~o@;!#y{*ri)`>Ofjh=GQh${|(k=}~%s8G)r=*xOiG6IzQf zW3e83@GB1`X%ACK-=K^DAo>WPK9sO~2HcRip^6yvD6X3zVrT;*s0I1APGPT1aC~S$ zjO!f^Kmnkz(?e<7mVynzJlqIY0Rz=KzJZD|EdZuCl^B`!elrWKP76>B79a{1##w=3 z+sB6?JlHG)V1wU7IGf?pg>lWYu`v;XC);Dg<=~vg8UQ6)FhHcHLI_YJ=!39^z#ta8 zN6lcTvL;bbF^ucMk1}p%oK-yy9}hZls|!vbl!h9thhhP7TChV{-%RyKeVERUE3Zjp zQLIh?NHk%6TX#DbZ)?$06bFLR0N6oiXR$qVD4}I|@DIuo**TxPx`mq)08kL&Bz!s~ zOrVY#hPtR>9NHK^6@xQgBmnaKz}SrmhB@tBynNie_ri7JuLy15;H(N$0jeI0^@RQ? z%EiLReS0nel()$sVEbf)bv*>X-nS=gkh6uC>u1Jou!5VAxYmEnH`ph(9;To$AGdSR z0OMqH`U9ZdXLH&WFv2h;U<0%Dm0Q8E6fE<+9tEvKiK4?}LiZEFM?iwYO()pquVyvK zhZ#i9ZdMjx2S8Eg5QXl+0|YoFZ`P4z!0s``C|9t+?E)W)g(9H&jl<3LKg-e3zz)An zC!Cr%2hkcM&yN{Ki<@E2N59W3+rzmTrpZWr}o0R_QRp!xZ>eF+`YZbwpZCN zVtY~H3T~oW@xQ0?eD_CxDfO=b?AEqh_@0jW=3o7(nCVZkCqKo06Tx~z72v)G01F7( zA!87rOp9H|*^=CQF9?QtU2s&m5nF7Jn1!DlFrq;pwg-z+gu55`1e1l~qC!t4Y%eu9 z)a|9#iG_B=qQQBXx|a=@NQd0gbZlAcp$?Gm#{5L;YzY z^`U0rQzdbC^YlVl-;(_jQz-qi?VL4h;3-zRXNk1r6qEAO(!=i`U*g$&J$hCwJX*Fn zry(@W?2)YdxWPV|_^r6GI)Qb*Q^OT4`kz_PZ6y%Dh-StFleg+$k-IJ9CdZQ=Ouv(z z=6vsfwy95kfAXC>LMQ19%jqsEIxnnqFz1py6^}9Hi58zJ&N+3Zz2F+B9d8x&Sh98S zO(_LpTEXzG51N}RoFTv#;BiH)Z$VPD;LUnXvC-dmVhzbJcg{V6bIG@s@*q zinWbOc}z-$+jW4aVfxa>hwzBPz67h=%1&E5xd7i~w>UTHZpWIc3o))|t7*0E1s&zs z$U{tIJT{IG3eXvqOPKV1CPH`E($OEzJ8<&=?+26ClaeumTeq(eO^j#r&OR*36TFex zktVb^L?`Td-}sTZW17yTU0<@7Y*piH@fl^frbA5MtZZbKq~+PgRl5qT35{npb}XeV zYY441gEq_TmbrTgwTh(uhRlx49NOz4uIwaM{iBR`svG6hGQNH~dXAcx`0Qu~``!;_ zk?2cxGv@?(cNO?q%Na%yI`t-xDMUEG9E)U`!BVm}_)WGQslM?+>S}KkH*+o7Mf}TD z!^PD+FHGu0S=F5H&ASG5Wm1OPMP1OKkZ2*iJg*R#-V%A{XfY<>jelCf@f))EuSuWz z=U;lVz+G(?S#*8);JY{q*7RPl%I9yVDPzY-h57>o8A|Pz53HUjxl1j&BCr-TI<^!d zPBTuJJE!k)fIf)xbbdCr^!9_^INyPRvz{b*#yx99k^v!VqP6LilFj6DwNuv!4l9XJ z6x}Uk36{gAEfQ^Cot5{;RN&9~0>f2aQjk=M6j>(3G90@Q!@(HN@I5 zU#S%YVwSc$%NQt|f?j^m4_AJu{m$jlSIS=1_VlZgZ2U!% z&X+1JCm8gL%ifWEx{|-lT2M40mvpN5%G0|EGlbniw^!=1XUbD`xXVedKBCD;8O!D> z`r_@o(Q_=_pO)j0xv;g`&?6zLPKA$svhh;ntfTp=f?`1xfqfmPk5Iesej-cK;XT6p zOn^0L_3@;pjqjP`Dr#4~6z6tRT=tXPdbccl=JTGeV;o79ul-c7P~2WN&7!;muQ?}Li<(2r%l9cT?oqsc_{EMKvm&MlXRHNM2*;?CjS64dU z6R$SfN&HDm*YNf2Da~ZY{a;YqEw6i~sL_gOKPUU5X|yNUN3aGvSwWSiuY8S&C)-%; z>Eh&=^V9-M$Ux6C1-++73sk1wbZyF1zEGQ3-sN0QTMYnLy5{5R)k4IU#X{ z{-&<@Dr=WYcP;fX>(ucw1(n?42c`wFTT`k!GDnq|XzU$%L#N8^&lU;uXGV70 z`b@|E#akoN9by5*0*D0=3m_IiEPz-5u>fKL!~%!~5DOp{KrDb*;Q!hJiI0WFUwsX= z7tc&+zEWQ}Rl+kbPb;}UZb^cfHuk~kd%~)ANsq6A2A8kB0v7bW`}z*YF8aF{9U3iF za7putKNm}}=aJH9LmA`j+wZxHzvdj6?mC0ty{W>4-qbP}F55LS{V^nJnS09g?f9tN zjT1{cXixv37$3gE$t$0pq^~)ZzA#UWd?qO3a5&->v6o1Bws7SGdiGf5=(~Ns?EQ;4?fqqiesm_1s?&$}swL)~)=aL83DeZhPF`*}Vtt(^q4Rn(i}$OiLMO^! z-sUU35a->|!DYrvUo{;eD(1O+u6Cv~?~CyYM-%Vm9#-AxQT6M)@A1bRlOIfs%CwJ& zsPee$5VJTVeSc2z9wyx_=chqbS-o555-XSg=wmI)` zxOn7vN(a@z#UeKuq{=7$Fv|Kd_f_Q{DYZnmuXpQ%<7(dgH`FA#^yb~dnD92 zQkC3Dn|bF(QLA-%9DDQ&Os^)&99B2G>AN?z8e47AWO(y_W7X?k<)i;RN2Z2xZN1gfuYEF`xi*PI`{c1AOQv9W(2o8A-4 z)5ou(_Skj9Berew*vSY7mJ`QqU+t|M$3MT>B_eH-u{gI-?04a*z3n*n?Q<70yblgo zO&W1HB@twa$*G!8nVuK#tj>xv^L<+=@6A85Z{AZxW238Hx|^Ozmbu%y<=~%aQhspMvKU_n|5Z zOT||o)m-&UB3#oWS9d)oR<5ZcVWpbG54o3FU1_<#_falS&Kf$m0veLmL6euMkrOTS84ZFo=`&>S{DqtoV(n^&`3=9`GzjwQVfY4aNYDR zWVGK}kC=6PaDM!JMxg8CBW(0CZ&zZ~oXpfMq=(7V@d#*|o0H9RWs(~WkGVV(C3KcG zThx8Pkd#^|^^{Tgh@;T{24uGS))mSW3^Dw#q~?s>&>-=PeAtlef;#JQbz zM@JiGWYdhphrV)(Yz?0sC(l`1IwZX!PO|$<*sk?+6?>;UB-hm*)wc37q=e-f=85!R z%Otv#C(Ye&oG({wZIwz$uavm7`q4tdAiNdi^|l8!6(onjOR&O>XmNURfSc)_K;_O3Ta~=NMqd7=>n6kY#4d;ky8@w2_58BoEG#}*l}0EBknpg zETYS&g*m+k-8?^$KF{5sia4lbsXQ# zDTc?h*POk^EK4<-dyu~Bp0Z&ISDgcoo+366bE%)h4E;QyMBRy+<^*kfN!Ccp4-)L=G|OM_V{P!b|FBs6%$)lBM0L^F7dH1g$OL&cHV-;^zPaa9XMD4@Rly@v z!Vy%3Hrdlw9kiDU?Cdp?ikHcWHX!wH7v?!C;?`w9pL+2XLz3mn>qagi0^>QI%nBt- zwaF9hJEzxO(dVdLdPI8h^jd*TwmDTI>TgK^^xA866itAhttl(>w_^XC_ z3QcGzMhi?8)b2bNRyM+w_}U>Szkp|Vidir{qaN|Z)4WVklGRAxHi}bcYKHcS<*}K# zPMHMYE6keSrF+&+-J0((irvw6MQyA370-&VUNS+3t)@KM#j)Lq#3krd3R`3Dmf4t# zfS~T27T>#?(YpywXV_*N{5}rP<-FzUDZ9?GI(91j&Ge;;B;K`+i8p2&a%Y>PRX=kd zSMS#GzalYQ&iuiMg&(|%RuUnUtPsZ@XdoPsXHzbI(SEl+$FWs zy~CxW=))toHrn19v7`|FyT*mmeL#Bo%o^IXN_tH zAMnX{5Sx1)xT7|xBJbI~#b0P)Ysh{?$eC`;Ch6u!&4FVqJmxx$oB67tOxKsvGpVP? zv;;|g#4`%c0oU3#!%4QC4eh#AFFRX=Cz2R-kE^I$@M$wD*wHYiEyWl4z_FJGh;{Eg z>qyh}B=Ju6gsMTB82RUO_<7Z=nT}$U5 z)G{j0eRQmf#9rh0NPLSXex@&xw8xgoJyO>C{Wo)juU>sE9^iPW-o%M1uX{PzWh81z z<6~BV>R^3l8EwKe|JV_(%?yn7Bh5G&|5D`*yx2w3ljn}v-F}fp_OQ~eOq18|=8n8s9%=Z$HyYO;*-4bj04VK`Hpf-J|v?Wbxs0K?Eei zbML2`2ZN}W?%OB}J-u&iG2rlOD_&*4`$EAoowVQ#PcX?~S7a2a%Ef-{o>9viSe>2Ur-ND7qEvo%tetfMtn!0X# zhgQmu=2BLO(9lNA+t$&yl@g4EplN0K*aEY9;!0WGtZzCrMBGiYE0n&GZ`E~`OMd2! z;Km75S+zuasU%Y4Kvun_4nqk``Zg zX%$?WpF6vVx0WyA8`315AI9`(M!9yRT$i(WXi`iVIx$Sy~%uNdS6@)vn)`)de zsg{pZbI9H)^PvsO^HLlmesN1{sfA_uIg8iJ7x!{fV|E=r9(wf1E;~Je zj^lYNqXdIldxuM#+Qhq09+Jf#Vv^A~qW50wNhN1fZuD$sI#F@J+>sfd+)MZL;uY$% z!Vl)j(Th(FdF`g}JydHT{^jC`SN~E2Cml~PYjc+dOPOv|@p@U&C7DZ_#Wj6lx5P)= zT1R+M&QJE~mF=G@Jc>Fkk=zk(UR_vQFa3mS^MMT-<&!z>t2ZJwkKH&B=&8QjzD53P zFM*<2VN;AGO&HMtrRk7@8^$JOI8sFBny6IwwV;U(AB|CY-G$wgdqO-Ng7Roj3G7&O zv!yxicKDhXC;o@UG&T|9brV`W>639D;TOX0p+BjJtrp$iI-xnPTU?m5nI%y@u$o1Y zWV>oS+gKS>KX|Q09)FIK=qT%MyZFm3BACdx0g|W8u{$>KsA_Indb+Lb)9KG;YJ0MC zcR`>@J;7_)*e!p)2ZtL?pY~<36WtoWxw%e~d`M@Qkp1SmI2meJy5a36mQGWZ_!Ndk zhf!3sU!>W9gKSbkogKdDm*VhOb!_b8UA%X~b-mHFL+zmgCla>4lFC%laoI%wyH`j~8vdy`COQOfcn8&F^6< z?RfZZuJ6-Z9E+*s$K1r}FVlUgBTUF&RU$K@zQj@QfBl$#e8HNj+YSZ-_uG$%Rm$XF zSH2+fORC@`H?I?SkelL^pWf_2Nm8$vT(CB_>C~xzi0@>!!}4nBbV%r47V5~3EOl3+ zh3sx(eMdt}5gFR*M5?aW$=S`Xh0nYwmJa%Q^zm|yR*00xxFPkt`OWjnQn{xSdOtL3 zgfRFr-!mLAenkKN{Y#NCOdtRLSO+HQwSIR++szrLe4?~von;}PtB}ylRxeInE zJ}Tn5`-M7Q#FYckgmtFaVa2(m(4uyrengW&dh)9g zcfuNRQ!0q1;JUhH$*4*l>YDaIu+MS%rrf<9wok?1UEsECS@%~mwKGp6CdB)!_>_k) zpYlvgO23P=Jgco$yzNt|8(OcL=dQRvD(Iy^bM{DQk$rqMWzPHP=Dgj=wXvwE zgo)o;=Q-Dx_*w+lBDfa8wf|&Xd+mnH$*Sg|tWVWVn*UUcO9DvY+t83W2tSNa>cJQh zOe5HSN1Ga^2?Df=tEqjq`Y|Q_9ZZyvBmv(82jJWL)r=?tumB*<@EiF7pn`Dp$!eU# zZp%L`#D2&9Ze^$*~L;Bj-vh zNb%8Y13*nzA7g&Z6Jrf2Auu11LGF_~VA<-1bk$54H^J9j5`}5DWaXEim)XRv*#+7YiV_xqp+}++Usu68NWB07u&-hrH|PINSS>r3{I! zXkh(f8UzAbLOtD{p}=MSZG<+u?6%GA4u)70;x}Lp$aD=pikuLPxV5p3;#@2sMhWCC zz+PD)LOsT@54Rb*gg>aV-}~S`h5Kt4e8K=7ZqH_c3Wm5Z5Eh2b$r*fvk!k{Ih*jZV z-GKP#Gvs#bfI1k4+}c2_vz?U^B)vifQ6M7d8|f7&D2rGCu>fL$zrO|k$778)a;*6eoocYivF6YHodY@6{QdVDL_@>^hz0(OEPxQ1 z5F!&oWI~8c2$2aPG9g4Jgvf*tnGhn=UruEDFT&G*!=WG$AA$G?#77`L0`U=uk3f6` z;v*0rf%pi-{~H4JKco`!Yd`W5^M3=Y5&5$bkbna3BW`