commit 4ad686b9c0460bdc88663b882e5039b808bf8cce
author Garret Rieger <grieger@google.com> Wed Mar 25 23:32:28 2020 -0700
committer GitHub <noreply@github.com> Thu Mar 26 06:32:28 2020 +0000
tree 44acd5423f387f47621bc2fc74aa5d33ec16aa77
parent f0ce56bbd031a8b922e9695670c09c8a385c657f

[subset] fix fuzzer timeout in layout closure

Bail out of chain context lookup expansion once the lookup limit is encountered.

src/hb-ot-layout-gsubgpos.hh

diff --git a/src/hb-ot-layout-gsubgpos.hh b/src/hb-ot-layout-gsubgpos.hh
index 9c4710b..0c682ae 100644
--- a/src/hb-ot-layout-gsubgpos.hh
+++ b/src/hb-ot-layout-gsubgpos.hh
@@ -76,6 +76,11 @@
     nesting_level_left++;
   }
 
+  bool lookup_limit_exceeded ()
+  {
+    return lookup_count > HB_MAX_LOOKUP_INDICES;
+  }
+
   bool should_visit_lookup (unsigned int lookup_index)
   {
     if (lookup_count++ > HB_MAX_LOOKUP_INDICES)
@@ -159,6 +164,11 @@
   void set_lookup_inactive (unsigned lookup_index)
   { inactive_lookups->add (lookup_index); }
 
+  bool lookup_limit_exceeded ()
+  {
+    return lookup_count > HB_MAX_LOOKUP_INDICES;
+  }
+
   bool is_lookup_visited (unsigned lookup_index)
   {
     if (lookup_count++ > HB_MAX_LOOKUP_INDICES)
@@ -2074,6 +2084,10 @@
   void closure (hb_closure_context_t *c,
 		ChainContextClosureLookupContext &lookup_context) const
   {
+    if (c->lookup_limit_exceeded ()) {
+      return;
+    }
+
     const HeadlessArrayOf<HBUINT16> &input = StructAfter<HeadlessArrayOf<HBUINT16>> (backtrack);
     const ArrayOf<HBUINT16> &lookahead = StructAfter<ArrayOf<HBUINT16>> (input);
     const ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord>> (lookahead);
@@ -2087,6 +2101,10 @@
 
   void closure_lookups (hb_closure_lookups_context_t *c) const
   {
+    if (c->lookup_limit_exceeded ()) {
+      return;
+    }
+
     const HeadlessArrayOf<HBUINT16> &input = StructAfter<HeadlessArrayOf<HBUINT16>> (backtrack);
     const ArrayOf<HBUINT16> &lookahead = StructAfter<ArrayOf<HBUINT16>> (input);
     const ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord>> (lookahead);
@@ -2253,6 +2271,10 @@
   }
   void closure (hb_closure_context_t *c, ChainContextClosureLookupContext &lookup_context) const
   {
+    if (c->lookup_limit_exceeded ()) {
+      return;
+    }
+
     return
     + hb_iter (rule)
     | hb_map (hb_add (this))
@@ -2262,6 +2284,10 @@
 
   void closure_lookups (hb_closure_lookups_context_t *c) const
   {
+    if (c->lookup_limit_exceeded ()) {
+      return;
+    }
+
     return
     + hb_iter (rule)
     | hb_map (hb_add (this))