From ba0386060d92dffcde2d14f9e523a46ea8713de2 Mon Sep 17 00:00:00 2001 From: Michiharu Ariza Date: Thu, 18 Apr 2019 14:53:35 -0700 Subject: [PATCH] fix oss-fuzz issue 14345 --- src/hb-ot-cff1-table.hh | 3 ++- ...-minimized-hb-subset-fuzzer-5923632099885056 | Bin 0 -> 25847 bytes 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5923632099885056 diff --git a/src/hb-ot-cff1-table.hh b/src/hb-ot-cff1-table.hh index 7fbda905e..51cc84694 100644 --- a/src/hb-ot-cff1-table.hh +++ b/src/hb-ot-cff1-table.hh @@ -110,7 +110,8 @@ struct Encoding1 { { if (glyph <= ranges[i].nLeft) { - return (hb_codepoint_t)ranges[i].first + glyph; + hb_codepoint_t code = (hb_codepoint_t)ranges[i].first + glyph; + return (likely (code < 0x100)? code: CFF_UNDEF_CODE); } glyph -= (ranges[i].nLeft + 1); } diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5923632099885056 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5923632099885056 new file mode 100644 index 0000000000000000000000000000000000000000..0a3c6df0ee0073d24d708bbc70d4d8acbba3a354 GIT binary patch literal 25847 zcmeHO2V7KF)<2iwy_vZWMr1OGgKq{4U8*p^px6*&#hRGdKtM#QbfQsItb;~PRBVXG zj*2aIjSWS`Siy=EYt(eJcV;iye0Oj+arc+(e!JP-@B8)}2Iif6-o59Ydv1B>f9@e_ z*sv%NoST1oMn*PY0r1gRoIn5m@z0BYvozsv)@ZKqlh~A)ymT`M06G3z)1NB;T7|#h z|9bsbcYbvKz+!=aq6K2IvxZN| zPECl($WBRSh3vG1wAA>dsMmQ>naMGk6Jlbsv*P1l-A+s$pO~7Mm7kcJ6`zn1lbjxt zk(C&e9G5tLd{jz&Ld<*d8EHPvt$wC_{QUgmQxkfnCM3saX2ws-j!90)h>yvN&uFG& zV=~fGhbE`x#3Us*)BT&jipBz6v%O^G_y}9510h6-hGqV!YQsdHc zQ~${J?-d!!?)vxY;n#eL3~9df3~Iha1UFy0_vrVRk~0z$CNzsSKPM?Z>!&gs@c7g} zFa1f2KUV!yF+MepO&+rz@hN|zVwz>9$7dv_#hHhMO@TObjpoS`mztKsrl61cnw6XO z>N+7K{uO6@T6RV=YkXqPD^6x&UNa*zJ|{l4nTl`L+T1=h@sEO=5GFbJCr-dCPC&@8M5ah`Vs^@anDop5U4Q2w zKR@T(tiNQ#B`ZK6hn_GAN?;#cKprRwrJ_7EAAN|{qiXaJJ+b1gT3ZdX8fTSgHP335 z)lRE=t7le!khGITNk&LAC3%wfB}*kMC7UJtB*!FYB@L42l9$$2*0$E7b!Y2d)+4NA ztjnzrTi>w0XI*FgIcLS$aCV%EbK$yhkz9XnB$vo-V`wfqzQdnrh*rS{TRQnl1g>M!jrO_NTQ&Xz8bu8@8#-7MWM zy&}CMeJPX3Y-CT3 zO#Y4hd$|cquq{^M4%i)gV}INo_rt^RNF0r0aRN@mxp*2j;Kg`3UWM16raYG z_!7Q`Yw&IS0DplArh>I#D>w*R!A0;A{DmMP)ENg8M}JXJQB6!88B7KrcuLw3r-R;f z5Pd7UGZnRZYcld0u_m)gK?JdXj=IO;tQ*yb*WWxksU&x?X5HeF^#{}yaht<6bfa}@ ze(}Z)#mm=ysNKM?pSf&WmO5?n)MO1wv@Tm-kd-@QTJ}tB2A}=W^kt>$b;ZlJX%yr; zvRm~X9mCJFKoqQ| z{OIA2cb@t{Bd83+mW}rxKb+#WyNB0aI`qla&yva`GLokjX$}^xUc1|A`-xcwt(UWE z^YUp)=><8-$y2u+DJosDL90Ng8YDAC1J-7XQKInJ!59!M3Z#Y{SCIr`+vg(nrxmml zso*?$GO?*GM~^p11(gTiGot4;&YdT%smR^r6?f@9@*XL@LrY0Exp%KAfEQHLX`fTG zIK%ql4Qp3UPf2}m%B0v~%M6;?QJmr2)FYqmFTZgkcH^+rjQ0&1W<%mAjKy?$9Vs4) zg>Ne=>lSGP`IvcWY419{o3{CrIDoZrHf#X3r*`LJN&7erL23Ik`=|wFy(=5!h)_{@K6(pPmTLS~X0O_- z{&Zi-=?cP4VbeZDyud4dS9IXmEvMV%BPn95#wYSNn^q3tooIxRBBI9)l0Z?2#^?Z+ zIJ2jXEFRlFbP(l&ca7VdsWD6#n5#}+no%-UBjnz~%E!*4(or~$zs?~Y2Z}-sKG{f0 z8kH|Ph)O#_wTFM+B<1M)yg+UmJFALC`hj!|CizmK%4kxN2YEbw&{W8|8~fMNhijzd zp|Ozrs;R$J$hE(Yl~pcmY;AX(c)9!fOlFqroT1x_!5Se}L= zrfqdw3eRs>SCwpeut+n%mZO^40Mu^$lKyGxVcE&yd77Tmn>p)~hGi5Ej#E>i;vJ%y zttqPIIxWg8yI8*D&r;soMEoO|u!Xd`W>s!C)fZLi&&qOvrHgxxhtZwa2= zv7mg)>}u*4*z_&y_5$O#9QEUcI)^$!dBe2>kJe}&N(1tH4l}6F2TO&E7@d41@x;O~ zX2`=h;GOZleW>F~HXplk24Ud%ysjfCx2h7eeNIp*4^qdf(L_8;&^Ci+I@>PXa^CSv z+jK+IK)T){R_dj5_8By~cs_`B?@2{9S!LX+@}>9*ub{Ce&-2eJ(ayVALUx*#4;2#% zYKYe*;(uKr`;9v*K0k+u?%b1e5~4FX4#V5)h97p?|LNI%_`dkAd5jH-v!~`vTeDVB z5mg@VM$>Lj{f-oJ_h^DtL3R^UxrCV5GQIa|#ob~nF2}s$EUV> z9l)FWDm#n~*EXHLzaolq8d_XWR!B+Mgj(8qU|15HzPal~j}NaXyE;ipn-)ggGLrZIn#Gg8dGxywx5no!R!CdW~2S#jZ;a_Z^=(uUJd(N)3@o zLp8!cIx>f(8|N5?W8ol1ABz%!UodspvKS}o+{d4GrJatrkye+k?KWtIxorORD2%6) zv`XS2)F}@!HL{r+q(e4V(gHuM{GlKMXVbzOqQCL^I#DPs#6q~Su?C&KiY2E_nPGSd z){MjNh>9k;v7RI#(%!Up4Q8$HvBobVu!<^NxK2{?Hu2>yN$K0fl?#-z&R0reY@Wr&e%!!!&p{NXIhy+$s3OOz=`mhGij7ND zw8Owq8ZLZ2qt;}VD{Q*A#yGPC4G@KbXe`hJ@3Z&b+YaCIbQJlD3?W~0t~}M#&)jBn zBjiv#sw%57M5re}023BO85gQ#WmqUL{;q`6i!w zK3_|2+{SO-7D!hIqo*{9y+IA0bO9ZurlVfa9E0XDZ|F!0$v`z3{EQTz#-_*aqH&~Y ztSXqMW{JXfkt{GadgF^^Y!xc5{=8a3)PixG!#%p&_BJzYo!gHPnT445l65?Dm;J*!w{&qf+Xu z6$+}2@@iIdH>-KnwA)jpr%H2-a~iN{6*xx0(!>&_p&fVN+`QX|zhE8fKJ{ z#4-|JhR*FG^}EQmT@vA9&Dkqei1fH2*(~f>HfhL^g49Ie(|S@+FBqI>L?KvsJ7EEw4#72?NWpu>E}H!UY=PeT;l9uMlX$EU)!j>GR3@tqxVNf#zcE*1m}X=Ms!>FUBN*ttPmA5A~eE1hdR^PU|yJh zb4-r0cMW@WoT?|2>x5iWUJfFi8YHAhs5OnKMdtmC1tL;frV?C%nbfBy~bRLk;=nrch6^>jb*ZI6-KTJa!Q5A2$f|w2J#AiuFG8zC<|A zHuz(A$n{)7)tP^bt)9bO4CJ&<j?J_6VXPzi7m;5>p$0962&0j>dD zK~N2F6Tw}8+X(If+y`g?s6(&`U<;t794rR74p0Md17H`xPJmAVtpeB%uos{VU>|~` z=H9cP0UiJc0QLhM2RMn~48SZvtF7QPz%hWs0DAy-1C#^o0Qd~x1i%u2B7n^RD*-A1 z)&Q&rI0tYR;6p%bF_Z$@W(BJO?cgB`&^`cWu@3-!f*=XN6TlB(B0wHMBEVPxW@m4J z_5dyb{=l#%ybbUUKq~+>KpcPwpatk`1)~8mZP|zv11tiF2UrNe%ryx>1t0;K03b(T zD*-128g>o^&<$V|z!-oSfbIY?fVF@Q0xSTK0tf)(05Sm`0^k8`0I@DF1;_=M3=j?I z$QzIhkOPnn&=t@XfDAxaF-!+^55a6e%>FX~)rCVoLXiN=05$+@1=O3f(nug3U=CQd zvw;MF{^_G{9gBc1(G1W|TzssALpG=d8jE(I{peFv zg|0EEeHYzFe_&AiU8@rkTS>BHfwkN^-g<)dZ0jY~CDt3Qjn>rq51fn(;zGDEt|!-v zd%|=46n-1Oli$Nv^3{Aj1H_)vlMMR4$AIo^**saXY^7|CY^`jaY_IHytWtJM_O z25!^knez4Wjqn}tt>+rsxYoQa+#SXa+F4;>#k8e7X-Yg-4mp4j@L+FCtcJw;uho~fR#{y@E6eL`KUeysl7=}o60P79pw zIQ`JZw@p!-Ct|QTQk)_h#P#BC@tlU&$Tg9gD9vWAy>_B@nfA1{R{Om(IP=bq&h4B% zoqIZubk1{L=KRF@Wm`$xmTgD0jcYrp?W%Tm?TXvGw|}eshW0h>nV-;MYKKx6CzrM^ zI+sB%qg`TMCc5Oitaqt!sdL4yYF7`}POd#&2fL=ZPH~;*y3lol>u%TMuIF52}-gu3N2Jom+$31Gh(RPuxCtd+zpy+gEPixDmG>-KFj=+(mbt zdpGwX?ql3nx$km6;(o&YtowEM=N?iI7muzUZ+ql>EcICKvB{&{B zU(t8CZ;5ZcpOv4B-#EWGzZ}1*etZ26`#tja_Mhv&F2F8ebijd5e5b-r*E^9w=fDwx zGXrM@t`9sK_#{XgG&E>rP*KpXpsJwHg1*=J>Bi`yby>POx>dTJx|6!=x+l7(V7uV< z!MfmH!M%g~1osOb5*!^oE;u)MQE*A{!QgAb--pKy73>K_^!Iy5vrv?z2( z=(W(7dRx7xzMno`pP-+l&(vq@^YxSU@9U@Or|W0x=ji9@i}fq@tMw)NQvG`U2K^@e z7X3E;F8v<;X?+E)R5a~Xuy6J|T2x#VJBf<^}9b?|5YE8_b?q{32 z)Jqk9qM~#sCNa6_sVFHD$#k z^tfJ9z@B=nG{-bH7u~CqTox7Nn(^Hn^t_&=)saM|L>~uZJE`Hq&eL~Fhf*62U0O$$ zOV1RZFD%g*u9sKTFCR=X zsTF-=VqcdraZ45yXvr<9;ry<18pS+1Du;}}Y2<4V^I6`jlaK`ks>*X43|cy^&J-s# z&=$+yqQOz#v^xzv>P=iUTa80hTPtU?3ZF|2Lo=gv4A}r_vHkM*8pUZ5)zwKxiHhSG zUB?m^Q86AfxO9-=l)RN#u}4JSq9Q|7+!0ZKte7P#mgX40xQ8}8C5N7hUmlL4@t39inNFv1fwBF@`#b53>s8hJ zcHe3!i;fJ8PNdfHnuKyLZqKa!`_zg}Y$CKNLuA}ei80pXr!s^tkM|!nk-BO+MkZaM zPkj@mM5ZjgQUPVf@1mL{z&amyKOjiRY#B za}7B;>U=|f(PYhl#EU!)TYfr_L^|DhzSf|fyMr^h=0;Gz=$oX&bPcK6&eKap-27FB zHEYzRhSH+78ghy8E*5b_yY!P=#Lwy8<6Jcz+>tWWLzd_;333;=i$-j0oQpp+5*2y7 zi8L4q8CKVn!V6~)AFMn(>hPeb(W3?llcr2hn>2obL70z~r3dQYJ>zud_z4C~Rab}a ziR?8zu9q-<`aLrD2AOeJxJURqgx;NzOLVpN#~O%t0}BokU4yc&;P+uHCf7EJYMx{2 zDNt1&7M_q6zPylf2ulV3?7Xn~ns6y`*}si=Y6YhUUzZrP8%5f1iJ`de{0N%B-RBjL z9CnIAi5SQeCCw}mmE8h)#nqh?d-sYc+0kTBfG>#^z-WmBZ=|CLUpZ?vRihMSs+e#xAj#wP8nKE%`_Pb6BRZ3@)tJ{2) zQy4EAMB2LFTe%|>HHWfBuj}K)g1nOr+J)UY1CcMUKE5e!h&jsJvVf!fw1FwqO6`7T zXv5PhWgo8AY%S&z%Z}$=UX3Z4tBOnAcJkAWn?LuqB8@(a}v%zc#uO{HlkBEBxE6ZG8GGbun(^os@WC65%rZVpAe;57_C1# z#A(p5;Rfx8VJxC~=o5`V`yba4?=!cHSqRDSf-E4T)MS(=VffsSH$0<-bm0H9nY#Rj zIn>}N5HG_+zK)@AFGPLE!P|!dIgWSP`;f5#% z%?3kjbe4I{rx@DuMwJXV6*B}<%KYZ{;C<$O=QHp9L*|`Ng#zYDFJahgF7wY9GjDz# zLm~5F5t_+7@-a>Dq2-FMpKtU)FMWa5b zJL-(WP&n#~`XL>f&ah`8nt_(0l_&spL6K-4nuRu?foLPzingE=XgexH{n2KIEnOJI zY{6h!OK=1sm4O#)R)8OWY({S=Ha#=l3}{}J*gZ3*LyUtkYsWEcVa0Hhb#o&-W-|n> z*~f}m*qdRcVD?cki-xf$3}kk-W44XNWFMbqTlq3euY&+K zHm4wvjm<@dUT?FHo`Kq0Ch2?j>CEiV1G+F9M8ObdjTjii`aBCJvVPBjG}hbskj{F) z6f&3vRzfE0`$ot@o6&a2VRk>jAoB@y9^Oyosm!S3ge)8;Uf8kw65EGK8EwU)bSLN@ z+L=1hd-Mkq(4HJU^5sXBxRx_?m>x@uDZC(i$vR@oPQ47o@P#LxsmYhpk%@VOhfFOd zDH<|LH(9Fus=&}|Lk#T{<3_`1Vnh5B%O?82b`$-d-7^1mGyMPG)ZV0LK`x7bVDS%r z#glFJ4=nD%zt}xso`J(Q0pYTy56_` z360wt%NmuHEP*AEVlvrRqz72&c5;p}KX>N_T-z8_uN=m1ZYv_P6ilZ^+%ombC9)d4 ziwp{4kF3YauUBC@%hbhFWD@07tcmjJ6imjEN$Xi^TW_p<8ZTbK4Nqo@-9~1H+C`QeT0*i zWt8M^!6sjB^_pcHwyKq1(soqQPn>KT=pj;f`spUT2fwJnH<;4hST>I_oJ`e;W#Ypc zvtAb(lrNZ4b~M`9%ad^%uG^n_wDKHIZBTyB_zrZa@w~5C#SBnA0@FZK^$c9~s?wTs zc+Df_wRTw9k?MZm#aG;hUl8%W$dWjfFMOFLJ~F@;o4N=%=T)-y!Ll+?Tshh4=(azsi=!ECJDuNNzr*lLy=`-0`h+EFlen88?gYwS-o zjJ}G)>y)1}z5{J(G=yQ6&ony67;(FRjZwqNdS&WNQLBuN=u;kFwQ1|J`EipoW8%jw zF=(EBr^=X8vU%(3RU6BS)7~!98q%ibXcR1eyA8|VzRnMz>0BL8Mwwz+>Nb@(={QS# z(sIaSIpq0;<4DUP&%fo6=NF