organicmaps/harfbuzz
13
Fork 0
mirror of https://github.com/harfbuzz/harfbuzz.git synced 2025-04-14 17:13:40 +00:00
Code Issues 1 Projects Releases Wiki Activity Actions

[sanitize] Add barriers to runtime-checked values

Browse source
This commit is contained in:
Behdad Esfahbod 2023-11-03 18:38:12 -06:00
parent cf49f3f2cb
commit 775320a4f6
6 changed files with 21 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/OT/Layout/GPOS/AnchorFormat3.hh
View file

@ -37,9 +37,9 @@ struct AnchorFormat3
*x = font->em_fscale_x (xCoordinate);
*y = font->em_fscale_y (yCoordinate);
if ((font->x_ppem || font->num_coords) && xDeviceTable.sanitize (&c->sanitizer, this))
if ((font->x_ppem || font->num_coords) && xDeviceTable.sanitize (&c->sanitizer, this) && c->sanitizer.barrier ())
*x += (this+xDeviceTable).get_x_delta (font, c->var_store, c->var_store_cache);
if ((font->y_ppem || font->num_coords) && yDeviceTable.sanitize (&c->sanitizer, this))
if ((font->y_ppem || font->num_coords) && yDeviceTable.sanitize (&c->sanitizer, this) && c->sanitizer.barrier ())
*y += (this+yDeviceTable).get_y_delta (font, c->var_store, c->var_store_cache);
}

1
src/OT/Layout/GPOS/AnchorMatrix.hh
View file

@ -38,6 +38,7 @@ struct AnchorMatrix
if (unlikely (row >= rows || col >= cols)) return Null (Anchor);
auto &offset = matrixZ[row * cols + col];
if (unlikely (!offset.sanitize (&c->sanitizer, this))) return Null (Anchor);
c->sanitizer.barrier ();
*found = !offset.is_null ();
return this+offset;
}

2
src/OT/Layout/GPOS/CursivePosFormat1.hh
View file

@ -128,6 +128,7 @@ struct CursivePosFormat1
const EntryExitRecord &this_record = entryExitRecord[(this+coverage).get_coverage (buffer->cur().codepoint)];
if (!this_record.entryAnchor ||
unlikely (!this_record.entryAnchor.sanitize (&c->sanitizer, this))) return_trace (false);
c->sanitizer.barrier ();
hb_ot_apply_context_t::skipping_iterator_t &skippy_iter = c->iter_input;
skippy_iter.reset_fast (buffer->idx);
@ -145,6 +146,7 @@ struct CursivePosFormat1
buffer->unsafe_to_concat_from_outbuffer (skippy_iter.idx, buffer->idx + 1);
return_trace (false);
}
c->sanitizer.barrier ();
unsigned int i = skippy_iter.idx;
unsigned int j = buffer->idx;

1
src/OT/Layout/GPOS/ValueFormat.hh
View file

@ -308,6 +308,7 @@ struct ValueFormat : HBUINT16
if (unlikely (!offset.sanitize (&c, base)))
return Null(Device);
c.barrier ();
return base + offset;
}

8
src/hb-aat-layout-kerx-table.hh
View file

@ -54,6 +54,7 @@ kerxTupleKern (int value,
unsigned int offset = value;
const FWORD *pv = &StructAtOffset<FWORD> (base, offset);
if (unlikely (!c->sanitizer.check_array (pv, tupleCount))) return 0;
c->sanitizer.barrier ();
return *pv;
}
@ -259,6 +260,7 @@ struct KerxSubTableFormat1
depth = 0;
return;
}
c->sanitizer.barrier ();
hb_mask_t kern_mask = c->plan->kern_mask;
@ -389,6 +391,7 @@ struct KerxSubTableFormat2
kern_idx = Types::offsetToIndex (kern_idx, this, arrayZ.arrayZ);
const FWORD *v = &arrayZ[kern_idx];
if (unlikely (!v->sanitize (&c->sanitizer))) return 0;
c->sanitizer.barrier ();
return kerxTupleKern (*v, header.tuple_count (), this, c);
}
@ -509,6 +512,7 @@ struct KerxSubTableFormat4
double the ankrActionIndex to get the correct offset here. */
const HBUINT16 *data = &ankrData[entry.data.ankrActionIndex * 2];
if (!c->sanitizer.check_array (data, 2)) return;
c->sanitizer.barrier ();
unsigned int markControlPoint = *data++;
unsigned int currControlPoint = *data++;
hb_position_t markX = 0;
@ -537,6 +541,7 @@ struct KerxSubTableFormat4
double the ankrActionIndex to get the correct offset here. */
const HBUINT16 *data = &ankrData[entry.data.ankrActionIndex * 2];
if (!c->sanitizer.check_array (data, 2)) return;
c->sanitizer.barrier ();
unsigned int markAnchorPoint = *data++;
unsigned int currAnchorPoint = *data++;
const Anchor &markAnchor = c->ankr_table->get_anchor (c->buffer->info[mark].codepoint,
@ -557,6 +562,7 @@ struct KerxSubTableFormat4
by 4 to get the correct offset for the given action. */
const FWORD *data = (const FWORD *) &ankrData[entry.data.ankrActionIndex * 4];
if (!c->sanitizer.check_array (data, 4)) return;
c->sanitizer.barrier ();
int markX = *data++;
int markY = *data++;
int currX = *data++;
@ -639,6 +645,7 @@ struct KerxSubTableFormat6
if (unlikely (hb_unsigned_mul_overflows (offset, sizeof (FWORD32)))) return 0;
const FWORD32 *v = &StructAtOffset<FWORD32> (&(this+t.array), offset * sizeof (FWORD32));
if (unlikely (!v->sanitize (&c->sanitizer))) return 0;
c->sanitizer.barrier ();
return kerxTupleKern (*v, header.tuple_count (), &(this+vector), c);
}
else
@ -649,6 +656,7 @@ struct KerxSubTableFormat6
unsigned int offset = l + r;
const FWORD *v = &StructAtOffset<FWORD> (&(this+t.array), offset * sizeof (FWORD));
if (unlikely (!v->sanitize (&c->sanitizer))) return 0;
c->sanitizer.barrier ();
return kerxTupleKern (*v, header.tuple_count (), &(this+vector), c);
}
}

9
src/hb-aat-layout-morx-table.hh
View file

@ -259,7 +259,7 @@ struct ContextualSubtable
unsigned int offset = entry.data.markIndex + buffer->info[mark].codepoint;
const UnsizedArrayOf<HBGlyphID16> &subs_old = (const UnsizedArrayOf<HBGlyphID16> &) subs;
replacement = &subs_old[Types::wordOffsetToIndex (offset, table, subs_old.arrayZ)];
if (!replacement->sanitize (&c->sanitizer) || !*replacement)
if (!(replacement->sanitize (&c->sanitizer) && c->sanitizer.barrier ()) || !*replacement)
replacement = nullptr;
}
if (replacement)
@ -287,7 +287,7 @@ struct ContextualSubtable
unsigned int offset = entry.data.currentIndex + buffer->info[idx].codepoint;
const UnsizedArrayOf<HBGlyphID16> &subs_old = (const UnsizedArrayOf<HBGlyphID16> &) subs;
replacement = &subs_old[Types::wordOffsetToIndex (offset, table, subs_old.arrayZ)];
if (!replacement->sanitize (&c->sanitizer) || !*replacement)
if (!(replacement->sanitize (&c->sanitizer) && c->sanitizer.barrier ()) || !*replacement)
replacement = nullptr;
}
if (replacement)
@ -513,6 +513,7 @@ struct LigatureSubtable
if (unlikely (!buffer->move_to (match_positions[--cursor % ARRAY_LENGTH (match_positions)]))) return;
if (unlikely (!actionData->sanitize (&c->sanitizer))) break;
c->sanitizer.barrier ();
action = *actionData;
uint32_t uoffset = action & LigActionOffset;
@ -523,6 +524,7 @@ struct LigatureSubtable
component_idx = Types::wordOffsetToIndex (component_idx, table, component.arrayZ);
const HBUINT16 &componentData = component[component_idx];
if (unlikely (!componentData.sanitize (&c->sanitizer))) break;
c->sanitizer.barrier ();
ligature_idx += componentData;
DEBUG_MSG (APPLY, nullptr, "Action store %d last %d",
@ -533,6 +535,7 @@ struct LigatureSubtable
ligature_idx = Types::offsetToIndex (ligature_idx, table, ligature.arrayZ);
const HBGlyphID16 &ligatureData = ligature[ligature_idx];
if (unlikely (!ligatureData.sanitize (&c->sanitizer))) break;
c->sanitizer.barrier ();
hb_codepoint_t lig = ligatureData;
DEBUG_MSG (APPLY, nullptr, "Produced ligature %u", lig);
@ -765,6 +768,7 @@ struct InsertionSubtable
unsigned int start = entry.data.markedInsertIndex;
const HBGlyphID16 *glyphs = &insertionAction[start];
if (unlikely (!c->sanitizer.check_array (glyphs, count))) count = 0;
c->sanitizer.barrier ();
bool before = flags & MarkedInsertBefore;
@ -793,6 +797,7 @@ struct InsertionSubtable
unsigned int start = entry.data.currentInsertIndex;
const HBGlyphID16 *glyphs = &insertionAction[start];
if (unlikely (!c->sanitizer.check_array (glyphs, count))) count = 0;
c->sanitizer.barrier ();
bool before = flags & CurrentInsertBefore;