Commit graph

429 commits

Author SHA1 Message Date
Behdad Esfahbod
997986ab30 [subset/hvar] Error handling
Fixes https://oss-fuzz.com/testcase-detail/5029952234586112
2023-07-09 15:16:06 -06:00
Behdad Esfahbod
f60dbd906a Fix thinko
Fixes https://oss-fuzz.com/testcase-detail/4787105656864768
2023-07-08 16:21:24 -06:00
Behdad Esfahbod
25297408de [COLR] Fix PaintComposite sanitize timeout
Was timing out after recent sanitize() change.

Fixes https://oss-fuzz.com/testcase-detail/5692635449524224
2023-07-03 10:35:27 -06:00
Behdad Esfahbod
0cf759b0d4 [Glyph] Don't shift anchored Composite if phantom_only
Fixes https://oss-fuzz.com/testcase-detail/5114131137822720
2023-07-02 12:15:43 -06:00
Behdad Esfahbod
cc44b3bce0 [subset/cff1] Handle an error condition
Fixes https://oss-fuzz.com/testcase-detail/5191907895279616
2023-06-29 16:13:19 -06:00
Behdad Esfahbod
62f5ed461e [subset/cff] Fix an infinite loop
Fixes https://oss-fuzz.com/testcase-detail/5419002026131456
2023-06-28 12:04:28 -06:00
Behdad Esfahbod
347b944811 [null] Fix getting Crap(hb_bytes_t)
Fixes https://oss-fuzz.com/testcase-detail/6187272924692480
2023-06-26 18:10:36 -06:00
Behdad Esfahbod
6c4f975dcb Add a fuzzer font 2023-06-25 23:37:08 -06:00
Garret Rieger
db700b5670 [subset] fix fuzzer timeout.
Fixes: https://oss-fuzz.com/testcase-detail/6681253479579648. Limits iteration of coverage table during MATH subset to valid glyphs.
2023-06-13 08:42:36 -06:00
Behdad Esfahbod
2e6919d526 [subset/cff2] Error handling
Fixes https://oss-fuzz.com/testcase-detail/4916785942757376
2023-06-10 10:08:56 -06:00
Behdad Esfahbod
d08aee5a7e Add fuzzing test 2023-06-08 13:20:28 -06:00
Behdad Esfahbod
ada1e9a924 [graph/serialize] Handle empty blob
Fixes https://oss-fuzz.com/testcase-detail/4877513265119232
2023-06-06 14:46:47 -06:00
Behdad Esfahbod
a92b288e65 [serializer] Handle snapshotting when current is nullptr
Happens with memory failure / fuzzing.

Fixes https://oss-fuzz.com/testcase-detail/6292420615340032
2023-06-06 14:32:25 -06:00
Behdad Esfahbod
c2eaedd2cd [fuzzing] Add a test font
From https://oss-fuzz.com/testcase-detail/5855710991482880
2023-06-04 09:25:17 -06:00
Garret Rieger
f3b4d35f36 [subset] Fix fuzzer crash.
https://oss-fuzz.com/testcase-detail/6608005089853440
2023-05-30 18:56:48 +02:00
Garret Rieger
20c564bc76 [repacker] Fix fuzzer memory leak.
https://oss-fuzz.com/testcase-detail/6419865171525632
2023-05-27 01:16:46 +02:00
Garret Rieger
a652281ed6 [subset] Fix fuzzer timeout.
Fixes https://oss-fuzz.com/testcase-detail/5979721620652032. Timeout was caused by degenerate map insert behaviour due to poor integer hash function. Presize the map to avoid it. Also fixes collect_mapping() for cmap format 13.
2023-05-27 00:25:47 +02:00
Garret Rieger
db23be642f [subset] clamp head *Min/*Max values to fit within 16 bit signed int.
Fixes fuzzer https://oss-fuzz.com/testcase-detail/4549472192692224.
2023-05-01 20:28:58 -06:00
Garret Rieger
b3fed4fa64 [repacker] fix fuzzer found memory leak.
Fixes https://oss-fuzz.com/testcase-detail/5196242811748352
2023-04-27 17:18:47 -06:00
Garret Rieger
2175f5d050 [subset] Fix inefficient ItemVariationStore subsetting w/ retain_gids.
ItemVariationStore is relying on the assumption that the inner_map is populated for all output glyphs, this is not true for subsetting operations with retain gids enabled. Fixes fuzzer timeout: https://oss-fuzz.com/testcase-detail/4575222591520768.
2023-04-24 18:11:48 -06:00
Garret Rieger
647b024784 [subset] Fix fuzzer issue https://oss-fuzz.com/testcase-detail/6521393809588224 2023-04-18 13:21:46 -06:00
Garret Rieger
2cd81fdfb6 [subset] fix memory leak.
Fixes fuzzer issue https://oss-fuzz.com/testcase-detail/6169920089227264
2023-03-30 16:19:41 -06:00
Garret Rieger
be87200106 [subset] fix buffer overflow fuzzer reported issue. 2023-03-25 10:11:46 -04:00
Garret Rieger
79ae6b657f [subset] Fix fuzzer found memory leaks. 2023-03-25 10:11:46 -04:00
Garret Rieger
f0f7f22525 [subset] fix fuzzer found null deref.
https://oss-fuzz.com/testcase-detail/5844352760152064
2023-03-21 11:41:09 -06:00
Garret Rieger
3d05b96181 [subset] track which glyphs have allocated memory so we can clean up correctly.
Fixes https://oss-fuzz.com/testcase-detail/5388270411579392
2023-03-13 16:03:58 -06:00
Garret Rieger
7a87b17742 Check for failed subset input creation in the fuzzer. 2023-03-13 15:21:25 -06:00
Garret Rieger
28b05e1cb6 [subset] Fix memory leak in glyf subset.
Fixes fuzzer issue: https://oss-fuzz.com/testcase-detail/6525813890875392.
2023-03-08 17:02:04 -07:00
Garret Rieger
9286e12525 Don't subset a glyf table with an unknown format.
Fixes fuzzer issue: https://oss-fuzz.com/testcase-detail/4875306193518592
2023-03-08 14:51:54 -07:00
Behdad Esfahbod
2d33a6b4df [subset-fuzzer] Protect against overflow
Fixes
https://github.com/harfbuzz/harfbuzz/issues/4137#issuecomment-1448994447
2023-02-28 15:31:45 -07:00
Garret Rieger
c0fac016dc [subset] update the subset fuzzer to be able to reach instancing code. 2023-02-27 15:07:04 -07:00
Garret Rieger
918193ebf9 [subset] fix a class of fuzzer timeouts caused by large shared coverage tables.
More acurately estimates the op count for CoverageFormat2 tables as the population size instead of the size in bytes.
2023-02-22 16:57:39 -07:00
Behdad Esfahbod
64fa5cd482 [GPOS] Fix assert fail introduced recently
Was introduced in 8708b9e081.

If these lookups are recursed to from (Chain)Context out-of-order,
it was possible that last_base > buffer->idx, in which case we
were attaching marks to a base after them... and an assertion
was failing fortunately.

Fixes https://oss-fuzz.com/testcase-detail/6377756666757120
2023-02-07 15:52:53 -07:00
Garret Rieger
e4fff64ce3 [repacker] check duplicate() for success.
Fixes fuzzer testcase https://oss-fuzz.com/testcase-detail/5475787333828608.
2023-01-23 18:37:13 -07:00
Behdad Esfahbod
b63159e8bf [PairPosFormat1] Fix stride
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55287
and generally the lookup with MediumTypes.
2023-01-21 15:51:40 -07:00
Behdad Esfahbod
3c972867b9 More s/hb_font_get_glyph_shape/hb_font_draw_glyph/ 2022-12-23 13:37:59 -07:00
Chun-wei Fan
4622be7f84 test/fuzzing: Fix dist
We need to dist the repacker fuzzer test items into the tarball, along
with the items in graphs/ and sets/.
2022-12-22 06:44:04 -07:00
Garret Rieger
40342c9437 [subset] check for addition overflow in hdmx size calculation.
Fixes https://oss-fuzz.com/testcase-detail/4877336988483584.
2022-12-21 16:44:06 -07:00
Garret Rieger
b5acde43ed [subset] check pending/subsetted tag sets for alloc failure. 2022-12-13 15:31:40 -07:00
Garret Rieger
35233d2514 [repacker] fix fuzzer reported stack overflow.
Fixes https://oss-fuzz.com/testcase-detail/6014493291577344.
2022-12-07 10:32:56 -07:00
Garret Rieger
b17fbc200b [repacker] use memcpy to avoid alignment issues. 2022-12-05 14:13:47 -07:00
Garret Rieger
f1d3489388 [repacker] bail on failure to alloc assigned_bytes set.
Fixes fuzzer issue https://oss-fuzz.com/testcase-detail/5390364397928448.
2022-12-05 14:13:47 -07:00
Garret Rieger
239a5aca02 [repacker] don't allow references to the null object in graph.
Fixes fuzzer issue https://oss-fuzz.com/testcase-detail/6714085985353728
2022-12-05 14:13:47 -07:00
Garret Rieger
16f61a1c87 [repacker] only build repacker fuzzer when experimental api is enabled. 2022-12-02 00:02:14 +00:00
Garret Rieger
de5a621322 [repacker] enforce root node having no incoming edges. 2022-12-01 23:37:16 +00:00
Garret Rieger
30e405e470 [repacker] ensure link obj indices are valid. 2022-12-01 22:12:59 +00:00
Garret Rieger
554ed06fac [repacker] add cycle detection to the graph sort.
This allows us to bail early if the graph is not acyclic.
2022-12-01 21:52:37 +00:00
Garret Rieger
9e99d08470 [repacker] validate link widths during repacker setup. 2022-12-01 20:17:41 +00:00
Garret Rieger
edf7a29595 [repacker] Validate link positions before running the repacker. 2022-12-01 20:17:41 +00:00
Garret Rieger
88d437525f [repacker] add test for repacker fuzzer. 2022-12-01 20:17:40 +00:00