From 139661404006b8be039436a81cb6b1a73ec44042 Mon Sep 17 00:00:00 2001 From: Garret Rieger Date: Tue, 20 Mar 2018 16:55:42 -0700 Subject: [PATCH] [subset] don't use pointers returned from push after array has resized in hb-subset-glyf.cc --- src/hb-subset-glyf.cc | 9 +++++++-- ...ash-b577db318b30f2851828a4c9ef97cb30678b1b54 | Bin 0 -> 22473 bytes 2 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 test/api/fonts/crash-b577db318b30f2851828a4c9ef97cb30678b1b54 diff --git a/src/hb-subset-glyf.cc b/src/hb-subset-glyf.cc index 0b84c856..4d111008 100644 --- a/src/hb-subset-glyf.cc +++ b/src/hb-subset-glyf.cc @@ -43,9 +43,14 @@ _calculate_glyf_and_loca_prime_size (const OT::glyf::accelerator_t &glyf, for (unsigned int i = 0; i < glyph_ids.len; i++) { hb_codepoint_t next_glyph = glyph_ids[i]; - unsigned int *instruction_start = instruction_ranges->push(); - unsigned int *instruction_end = instruction_ranges->push(); + if (!instruction_ranges->resize (instruction_ranges->len + 2)) + { + DEBUG_MSG(SUBSET, nullptr, "Failed to resize instruction_ranges.", next_glyph); + return false; + } + unsigned int *instruction_start = &(*instruction_ranges)[instruction_ranges->len - 2]; *instruction_start = 0; + unsigned int *instruction_end = &(*instruction_ranges)[instruction_ranges->len - 1]; *instruction_end = 0; unsigned int start_offset, end_offset; diff --git a/test/api/fonts/crash-b577db318b30f2851828a4c9ef97cb30678b1b54 b/test/api/fonts/crash-b577db318b30f2851828a4c9ef97cb30678b1b54 new file mode 100644 index 0000000000000000000000000000000000000000..00be056e640fb80c75ce452a5ee03939d3bc3a89 GIT binary patch literal 22473 zcmeHv2UJx@_wSxFbMB=n7X>URUO-U;3W8W;iLu3sEdeVk));#)h#DIjd&O>yv3miH zU9n;Z8`uRE#X?gwek$Den{z=)zAyj(TW`I$-dgW@&2RS1oH;Xl@7c3w&pC$>BcftR z1R0w(Zqjs5Bhyq;D%~YgdNm7d+reDASQ05-4T-v4Y}TPuqZd;j2a__}j>u_2+YUZ{ z%cn+dAz}c9^!};mP&OvWmB=Lsoi^<~dZf{7i+&A}ue{!|@6difjd>Tcov6xs+;g~J z&k;k(ii%^r1YEc4H)vd6&x5u(M0Lv$dp4+l=ucxijSm@5tT7!o4?ioJDdG@F$2C=1V_Lq?1=|3snS$0V;09o}c?#=h^*5&3k*J>QYkmEut> zV)D@DJ?y`JL!~ebey6e=s!Do;wa9#Dgt9D}!J??LaG>TQlvaqUG=s-cOT7;bRBNH{542ScpfPF#+A8J(gHRqp zC)52A*AH3?-Lu6L%N#3Y(4e5tFLMmZZie*Qg5-{b?@C zreD}I^D$8rG@DlIIn4n-bHxJcqTM%_dMJBQHiE7pYcYUk@nmw-aq{ASQe}RQoI!)o zrXhPxyFrVq!)O}vb3_Pqy_vc|o&mz2?AZ%iEYhem`0Jzlj=J#0w3r{KzG5&<*0n(W zHkzm8(p1rudMcUJ2&k`2r3qpdMe=9#t>R3JF{dL@Kc4>z#8O|(XD3|%1?pRGG^SvwKXH&YixV_QcbwV?6NQO|)C_%f5vysbh@&2AB$Z|FX_Xj(Ic-bsN@a3a z=g>y9S*YJY{q>EhC;Le2)tS)Q0rO)ujQWU0kY@q(@tS5S+`LEBq+a|KZRNkvFMK=A z;{$1m)Ty$Q#wlNsA3sAAl#kS1=}cinAAcvx9RfNBv^!`;&{|3n*nlk!Q%XQTBPdGU zMCG8verkR41J7gCy%Y`FL_I{U)!EcpZBN6*bP5$mXuVLVD)0`;H zD@F$03yM}%`W5{x)>ou`YDo%){r7|(*YGaT`*o_SGm?`qP>@(lt3`WYJ$b8{v_`B! z9(DXCRZ=f$@~#%a)K52-R_oS6oVmaB8}`(jHu43K=?<=`u)mGuqU%Xcn4f5|pH{2Z^ecQ#q;4)XR;OV;%wsDPqf}U%Ouc)%#o2si_VNZu?nOFv!8Ui|yrh(4Z`A`FK z#C%`tyE8?qdC*-ZbRP{KU@w@zt>PudXbZnopVr8AAhu9{V1U?1bztvx)v6e$A?)id z{h(Vy!O(Z8?t7}CdQmm;9kmyF8mB)_jdi1_fgXNPw}BR*?PyV!`lvg}Lp4%U*v2xQ zg0WwbH#gD{;Yegv8J<0#DhJ@lZQ#$bgNez=`y#&)kiPzk#o;T};kN;`A#Ah({P%BE zgsr3yz?Utj@}O;%>(pPlLtiV$sXY8xQ!$@@P@*XU>vxITnU=6HYOmi$jg`JM2ndFc zsS96IgNI;!z>n!VQ90cL`rT?Ybp8T)FU(sQ{K#!8C*0{PF_MgGbLytHg}$G{KV7E& zR&{8j%AofWv_j`e9d$|2PdxS34a7Q_kNsgDbiA9IU_ERRr>Ozj_fqW4CNULjRqiDY zRA2bebYVqaN-Nr{%%{N$hcAB(A3hl4&Y`b$*DVkkpsT2d)QFWob+HPduHaw#(eXf_ zu%}Ky2+#=remH12;0v_L#|qHiu=!@fi;9SjSCpNGH;D4z`(FXO&U zYM}O`5a=odwlGQ^PM#PyME?y{)VHMwbtJ~WgnNULFAu+A3;7#>*O#bkgZ<_>RTSmm z!z-aYkm~8$fv+8CTb8WUY^_a%m_RLcqmiEpeK?S4Pq}Btqr$r(h*C8)_c?A4>ah6N#_$HbHAF>I$8O&dsyJOx4 z@Eia-gsk8V6>t{9ch)HBT!pG4MB9Z#RjtKj?HGc;^NL@dIjl!0+ zcn2X>pf~z4D<{F()JTGJ!q=Zor3HVlEkX6^4wr z3PFpvWK8u>ka3ojrx4hC^BKe$%Ru9SL$D`Hd?jP7!a!^#K z@nmfIA1UHZwG`$^$}IW$Z>Wq(sq{>X}g_2&vJ}1Y3e*R9yK=WZaFH&EB zr`SukV13QarycTXZ!Km<-1^^A&4v)$7N)1kTF$$ii~m`wM@%l`Vre6C-ZWc5Y%b$t z8KW1bGES9osV0kzNyE)YHAo+ewf~QRe~^BpFj$)TDE#d_&^RDQ^Sg50{2kJV7l!ol zg~yV3(dpzQ~HXe!pUwm(R!@hA5NiNZX} zeWd_$zbFi;mjV=)p-^7itE5a4au3Ugwr=K{E313VHDRmu)FtL8s-M|W?TfX)+`LM= zj@U$7ADAa;d$8es(q{jD9+NgA=M~p#qpus<9Lrc-#@~pUw746wwRWbEYg?XOa9+aP zSH@VWGVa#aJg63T%QcCZU)rb~Q|nWn2eCKE@nvlNi9gv6?ZIEvU--iLKszf+KLGwD zZ<>FSYhK3Gl8^i|pypG+i}VLv#@|>UScktzzoeZ55r4}z1-ATmT43AS`B|Q;U2(p~ z`j&B)d@|pZ3CneaSLMwV`YIETuBms||afmzA$Gf00g|l)dIT`Fn_O_8JU`9vyPJEf<;>wqdGpWWG<;b&d{zQc9Z^I^P!r5M?8<%UdH*K z{I-n$rBBX3D`>uY4 zE$){4g{;FEs*J~F+%MyOd1ly0%XNquwfzL+%DtcfTKoL9^=XY@-;-lwT};PuiQ$=~ z!P-XPaH%LI8;isxPoucYgt)P{xkSanEf@|%OqPb!v3mpH1 zUf>eCMjtv=(aEx^M`O-$5n~FW*XxB9E~?s1s%)v~RBJ0m2ZrQu=s_r45uD2t9#~bu z0(g;Eahv6b-YglNPOqwZz0Sr)k1RSys@GXr>%p^R7Q@SiNQ9-KOi^Kl;jQ%YKfp?F zW338p2(5&iWo*5ylS5f+IXwom)>-2wO(&8inZ?L}6`G)}tkbgAdhI6gqZ6vNYR#pl z6vm)?ogTV?HlP%h3!P$(S-?E#^)`CFqPV6lhnF zNTIYJ?uDv#l4~emaxb71Ff7%f@hj&B`oSIAf0|n5sPcAUE$2%9BuC)HQjJL`^d{%V za+Pa}mi^-%MUOf9^pm1VtNHZ9ec%amtH=qIcWOU*T{bN!%Zr76S}&iTP0rz!0d6BgS<_k{*8xF}Vl zsRLr-XVDczE4W^WTBZtPNztJWs9AxrS~9Yo#+_x2$+l9P@`rZ$D>1)UIU`bL@Clof zY%3gP%S_A3!@{xwm3>(0!L_skt&Fw>>ab9ulmFy;u;}35Q^{E2pOo_7TNSF&c-HvV zR0)lO5xEM%mdvVH7lq7L8(0d9E-)Q`;REc$dU2mNaZnkUmEy|IG*<&XAfv57IqOhN zzE6YQ$Q&*h8w25#a9_&I)=U*(CSg76VdL|f5I3=!kR46#mZ6;a}#xGa)H zig=?k)u0x4Wv&fer@LmmzIOdrxzxV!jg2FXlZ~5< z+l)JmQO1MDBW|i&aW`i-cQ;SBs&3ug6?dJxy?ZhD((bPAUhd7^L)`mRIG>@sJ^4Z8 zna#OoGi0_%ZG_YtAoVVar8r8Ur<6rzW?;pbC#%G&v5qW+_0N}jJ=+bb-zz2ar9K0x zZ$fGWEcsIZ45{bw#r#(u#SilH{0gMTdp+SRnu{;lD`TC0}ZX zLQ;o9Y6htpr2Yu0VFl*5=Ev-&`2@RYK8~&P7;q5y1Hh9T77c6zc9@;bdb67MF7E}) zkjl#Ilh>Ge^AwGT;B0_YrUIKBCW$=u5sc z`M3dC2`t3*N}pQcVsos=>>Wkd?zuA~e~`7vccO3z1IQ-U9D zNC`}FODTbOim!n5uxSQ@cd z7!+Q|%IDikd!QFE4~PVg0+)e@mbQOQm8*X(TT03avh7As2#&kmKP$}(lSvO-x&Khtz2Qdy;}R@NwMm31_OW-8m1?aB^ir?N}g zO|xjWVp5`%XeCC$>0cR7bMOplBHocbQXVU*$`j?Of~ObCGv&GRLV2mAD;Y|rl11}r zfs(DfQeG=L${Xda@+U2%ManznU&?#sgYr?yrNy*_+wmgYz#VuoUR;@^gelXN_1uel z^D4Y5x8b(DD7VMT+|6f@iO=M-@T@tCqWJ>8kT0Sbtg|JwhcCqw+P!=^{lQn@sntpz zN&ERKIzR{cYQBcAA8?BQ#y8VxJSjbcwSJb)(RsQ+7y0jWi7xZUd?#Jy zyXYF<4X+i&qv<-`phUihr}Dj&#Q&h1d>`LWxA+0NO?T)nR(K5E?#z!ZKFuJaQ7 zWIRt`f~iag-|>`RWqM}Cti=?b#-FhgtRySNO7rLZ1yAQM;h!qAub7tzXWpy|tIB+s zub3*P!E5<3e^#Am@JtrKYOtEDmiSpr=UF^kj1gn`EB+eZccz%kTCvt*k_h8D{0)E0 z+OW1PkhNp&;q5!JPVmv=+4t-R79<$F7(!PW3J4twW}U?ZF;TdPGOP>h%DS=c@M^PJ z4^dV`upw+Ho5H4wxnd4mE=IF8gzpZBY!ByK^1ljMwA_`HLMVc~gxs}^fLwtH>*1p{ zC}Tn4O|VZ9^#*oYfOq8tJ0a{{MDQW-a9`IrJ42gIX(255o>$^=mP9x4&_ z^Ffny0__iAuDK&9=1hX1b0)_I zXc_1t3urm$dO+%U1?X-->JM|lvMk`3E1V5ADAPf)BWdp+ZP2gRj1?U&PR|D+>-30sw$ZIJP8+cqk&jXhM$;%bs zD(d4w;U^@d&k!II{4przRsy>Se5D11d+@!12J9?2YFa?oKvlpB?P0$H^N(*x2s;i5 ztP=?ior@wC@Kn&E7GN(T0Xvb9z6#G?HDG@tyc5+R{g)^P6h}YMxqKHdA^n+fvOwxl zI0Ge7e;c%v1yZk~v<2ATNVr%a{h%lVxT8<#8qbzUl*hgIK`U6mPk?#?KB!Ly^|b)| zA&J^Rb<{rx4X^;aBZ(S7E!1a#$~FLYOMDpy)I)tXXnhOhoZ(rL26_Y95cme|F^8g& z1=7!oZ!M5>DH>ZK{jO+Yft*{>6ljb7-+=~NfM-f1+F8IafVQ`Q$@%PH0lx^^(E=vt zwi6Hp9$+&f80Z53BImiQ1=4o#-arF?3ff)6dl~hK9zajD*Ms)T#}v@sz!22ifDQ$Q zq5m|{;lL==mjE3Nj6uEB=U5API_NkH@a+(Z@xTnUmvcA^fDe#+0-mE;5Dxkaun_g$ zpo@UTz*JxfupIT(Kvw`OF_xU8NMH@>Qr*z1T( z%U}ntxX%^sImUOb4>UkN88jT2j{G&y^*}cIL}ORz*Y!2(A)hOB|1;X`txH=#D&W%UA)Zi2OWI zUklhmP(Q#Q{M-Sp4b(xKMWA0>!0&-#ok}p+opGcEY$>SZ17OQQf3-l`v2l|HY&qy= zU>n-NPL10wkn6(;+mk>HO2#M)*jms7z(Lfn1BHzlk08H+@X*}?hH=~=y9C2HZq634 z-#{U&1jCqao)!@La;s_q`yCW>@75h{wh%r{w19yRcbx?k4Qg)z!`g6%zTJzV{Vveb z7RZ>!9Xgg^;N9KJ0w(WmZUKt{4Y5F;-rYliK4`y}r~>9#g6)HAWdQhK`w@nov_PKv zKcN1DKs|JjXSRTyK=}C)$VENcn#jAQ$vQA7im`dY`F2Uh*1SjeDkkP_G&UK~ z*u+Arm=tdl`^v3~iF+HHns|k#?SnjmjSk#DOW(tppaEX8f1?AYkmiIIIdqu;-70^JF{VY5XU4eMGxyT9+HxD;(7~Hsu$=bVR zhoB~4(G4uxc$+FUsbaGAHdO|(^Ny;>W*H+o1RZFI;G*|_E1K0Y=m1sXX+wiuOdep? zIBUNFddshqQWo(xHJr8INS%YCDpO;Z1NgKztugBDyiDXp(afNDv1kW|be}^V-wG}U zvce~nta;t4ZjQ+AQ-Ye;s-)$3`){jPaF%tVd+V>gO39pB!`r=-z0B!`b!+P9B6IqM zW4hMykU6Wceu1@1%baz`CN(^@UTj8(w5)*-x4ib*P77^gX=isUI->X2vaX1u!OmJI zb49=Qt60WC=Ik3*uUuBU*AV!Pg)53KW~+w)mU)YAP@0X1?je)OGVv+RMn<=l$q<>$ zm&tCKm}OF~G#e%F7$xr*CGQv&ZSN}Yl}V;d%DJLl51GuDNxV$VGHKw7#zSP{V??_l zNZ>2!E1UrEO$Ciblom>Ds58x^5c-~~D__%Ltmt_%`XtA^5OP#jk&(NREn*l)?5_sZ zM2@g=rwh}))_2hl)lb)N(qGiSuxeqIX&qp_)cU!Nug!3qt+vj#J#8o2?zR(l zmFz~_MHjIu(y_?Fq9uw>E4r&_mc7w_l>K@8_XdAMkYR{nso}68$?&JcFo%R<<%>-# z_Of_`;s+hcv9{w3$9sY7$gDc7Lfv~t&tfySYDPW!}7=hnz= zq}wsK3vQ`yX7^I=6Wo(MTsA1|NgK7D)! z`)u&J>XYGXWC*X&($Z!JTuLA6fRwyNEt_MSQpb;j1os@u5kp|4APy{Mi|y|8-M>Kp10sDGkC zwFX-nq&KY9FudWbZz_HB(>L3{$!XNOQB7cUl-*jBRnJrDw~Pt&FWEwtCZgOzVs`-P)XP%i4yv zJsnszFuGlvc9HF#weQ&eWQW=vwss8Y7~83Rr}XcKe*gRjpC3m3@Gz)Fuo`^4^EaK3 zcPZYbXP0GNqPslrN?o11KJV78+t_Z4yXAHd?tZCzZjVYm!g^fqk=)~Dk9Q#=q)W)r zp2d5P=sCIPoSuoj8unV(%iMc?XzkD@q3uF9hCT^>6`I$lO`p|$?)MGsd!nC9zwmx@ z`>p6-tbauRW&Jny-_`%%fbs*T4@e%6Igk&uALuf0z`#pCcKR`HP>n&6gFgQB<4=i$ zLk2$@(s0P)Ay0@`mY#8HSY}<~Qv7VdICb8Mc4esbLAjt%f%n zzIFJe;kSlA8(}x%!H5qdOOEs!*YHn7uUWpf9?#8RXHu-h$ukSW>+O&Jq-QR+L+y7hq=77!Pf3NWS?BCP3)Y~#`%c-rpt!=jc zy3J-=i*2FXVzyV>K6Ly39VK_n*b%c++1YF7=$#QeSMN0KJhAiE&h%a1?K-sEYIpzL zS9X6i1)4URoyM6qtlcN}_1$-V|F`>F?tgN?|G>HfnFsqHOgvN(|9lQD zJ@nyl=fi7`@FS&Mh*sEiCu{N=8v9)5`#P*Aw6uUTfTkOf$ zTd`Tk^~cK|_dnk1c<~uUeumDJI8*gZlQUh<^glEC%(63E z&Kx_FcqTng#JR-z#np>z9@iu8$G9xIJ?Zd}N?*y>`;#q$?a zF21`|^isu3^)Ge0H0aW_OOcmMm*Otnzx3v^-DRK4KU^ModCKJ#mv>!0b@|@qxA97R z(Rf1GN4D6^IQhyyp&QwMYEcAxwNR`52_4N)5>VcR@}N(DB1gP2%G#gE^*z`LL8*Lr zM%U$^#F<@Jx*(4r(()&9wtpxHWbt}2|4-uVoLLq0S0VoE`1bJwe~&R)5HCFiQ`)zMeyUfp>0 zz}1AScdx#_W^>K$TCHo}UJJf9^xDL0i>|G`7IW>`wZv-=ul?(~;d;gE4X^)jz4!HT z*B4yhd_DU5+3VM@KfnI=hTRSK8?|q=zwzUZvo{{xc#~Kpv3z3P#CC~Y6Z1I-L zQd&}0(z~0zZ%(+m_~y2o$8X-enSIOZ*2r5EZ!NvG=GJew4&S&~r5w_e9@yWjrmw%_eKw;SDVal8HP&bNo%9(Q}n?Hjl6-A=uocgN{Y**g{P)W6g8PPaQF z?nK<#aA*IW_&aHL+1-+NeeTx0+u&}?yS?rXygTLYio2Wcn(oHky?^)3J-d63_sZN0 zxYy=h=X-tc4Zjz5FXG;^du#7)zPIb%>3etYJ-+whezE&r_Z#1Db-&~NAMa1Szv}+4 z_YdE{aX;gM{z171H6FBj(C0zegXIrQ5B5KZeQ@i+t7O|`kK{VZfyo1srzA%v$0T1& zew@NmTvI$#{8H+tbi!-8=_zYc{z$o;@-)T#u;fGEhbpmkJ~*S@ObLu$j5sh$3K4ZI5*Wg)hX32 zwMuH^)GnzbQ|G4smU<*LF*W0f{zaPPX{~=f4cnXuBWG;-hKKy%_hy5=ABk6t#MjlTEDcgw54g=(_+&urrk_?oR*dL z@tM^#$7jZ8m7dLdmiFB1`H#=zUsQcD_QlzkZZF5a41YQI<+7J+Uv7T6>*XIWkG?$f z^76~Xm+9#u-6h>Gy=8i6`lR$_>ATaXS7rYf{$itfg5SvUX-2$U2>MCF@>RYF2vIo2=YyHM>Z*Q+COaWmscLIyk0eW)#6qASDjz=dNuIX@K@ts zO?_SDb?4V#j&Gljb6<{cUyg5Ij&J`Pj&I2x6Wrau9N+#o9p8ffSC4OI%g_4D@$LWO z@$E~z_$6Nae<)r&@cQ`cORpclexIY{6wN7}>a^5aON%7n#X^%Hlj7qN zrMT7))(V6I6{{Z{jrVT2Ga9ePB+*-ll}4g$>~f;*EHyI*ST(89GUSaSH%<$Jo^>UQYn1Y<`b>haH%E5$D~g%af8V! z0o`$r;{K{kn3L-eHkTEZsX8_Zwf4xgn}#p`wSuR2K8*WAZRWeO0KwtRbq}=VEk#hi01rKG8L~hg4!sAKz-ltJm=N zb9REX9`2q2B{We30;+pL4Xk<%qjtsU`Q@4CmuH?|o_T(G=K1BB=a*-m|3{yBj{h&7 zd47pu{~BO_iD4~qyNq7{|BPYr?yp<)I%313ePpf&KL0ZnF+}M;$G9k(a7H6Tl;`Kl z=;EI8C}t{UFqKI_8ddJ|H3Y@}HEIMHWE|{ai4745%Wzm2%jbu}2oEcIuo-ivEi;du ze<1hd<>wOyj-6(vyuNwngUiBZ%v-&94);@L3}-ZZ*v{13CwfGCdzvPndUF4d5fO8z zO`e61*AxoCktYyG9vdo3E&fBuFAxF?8S>*VW+b=FCrbIur#yc$d7z25(%Is2bP=tU zWZ%id!Nb8V0Dm;&=Ah>@&YwS+J3yIxI(G^??aZDn&)db?|HQLD)>h8r<5@3V;zdv>A_H+|h!UTNkJcAqk}17UROv#ss=l;TJaW^M7j-b1klcR!|yQ06dJYGPj9`1Vmh>{(dED`ZLE8Ogn8=s9uq28sLdP=eb z>V^qTmVP{4kDY5feA#YgZuPvnEe5XM%0I5mGuO}ikawlo(4&#ex&c#I^)~%-2d^8T zY^$4inlJB_+qL?&IH?tUvnpcn#a3}DLBB-vlBML_;85Ji|Nqo*4HYYlJ{Fq*=ot)IxGt+u6uzE^6~X0Iw~= A{{R30 literal 0 HcmV?d00001 -- GitLab