File harfbuzz-memory-access.patch of Package harfbuzz
From f96664974774bfeb237a7274f512f64aaafb201e Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Tue, 13 Oct 2015 00:30:50 -0400
Subject: [PATCH] Fix another memory access issue discovered by libFuzzer
Fixes https://github.com/behdad/harfbuzz/issues/139#issuecomment-146984679
Rebased by Mike Gorse <mgorse@suse.com>
---
diff -urp harfbuzz-1.0.3.orig/src/hb-ot-layout-gpos-table.hh harfbuzz-1.0.3/src/hb-ot-layout-gpos-table.hh
--- harfbuzz-1.0.3.orig/src/hb-ot-layout-gpos-table.hh 2016-08-05 16:57:11.042680389 -0500
+++ harfbuzz-1.0.3/src/hb-ot-layout-gpos-table.hh 2016-08-05 17:00:35.510672478 -0500
@@ -704,6 +704,7 @@ struct PairPosFormat1
{
TRACE_SANITIZE (this);
+ if (!c->check_struct (this)) return TRACE_RETURN (false);
unsigned int len1 = valueFormat1.get_len ();
unsigned int len2 = valueFormat2.get_len ();
PairSet::sanitize_closure_t closure = {
@@ -713,7 +714,7 @@ struct PairPosFormat1
1 + len1 + len2
};
- return TRACE_RETURN (c->check_struct (this) && coverage.sanitize (c, this) && pairSet.sanitize (c, this, &closure));
+ return TRACE_RETURN (coverage.sanitize (c, this) && pairSet.sanitize (c, this, &closure));
}
protected: