)]}'
{
  "commit": "66ef3397ea9aa309bcc4478730b3ac07fd0db3ed",
  "tree": "e95946dd2bd5ab324548f14aacce35792d527e83",
  "parents": [
    "485df9d5751b531363a9ad3ee6c6186f83a85abd"
  ],
  "author": {
    "name": "nussaiba shaikh",
    "email": "nussaibah@bugqore.com",
    "time": "Mon Aug 24 14:57:59 2026 +0530"
  },
  "committer": {
    "name": "nussaiba shaikh",
    "email": "nussaibah@bugqore.com",
    "time": "Mon Aug 24 14:57:59 2026 +0530"
  },
  "message": "[depend] Bound context inputCount to HB_MAX_CONTEXT_LENGTH\n\ncontext_depend_recurse_lookups tracks covered sequence positions in\na fixed hb_bit_page_t, but the dependency-graph path never bounded\ninputCount the way the shaping apply path does. A crafted GSUB\ncontextual rule with glyphCount past the page (e.g. 512) and a\nSubstLookupRecord whose sequenceIndex lands in a higher page element\nthan endIndex makes hb_bit_page_t::add_range compute its memset\nlength as (char*)lb - (char*)la, which is negative and wraps to a\nhuge size_t, writing past the stack-allocated page. Reachable from\nhb_subset_depend_from_face_or_fail on a crafted face.\n\nCap inputCount at HB_MAX_CONTEXT_LENGTH before the page is used,\nmatching the apply path; rules longer than that never apply during\nshaping, so no real dependency edges are lost. Adds a regression\nseed exercised by the depend fuzzer.\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "97bb725d257cbe7092ec5398509b85f891fe5809",
      "old_mode": 33188,
      "old_path": "src/hb-ot-layout-gsubgpos.hh",
      "new_id": "254901c2d301c279e1a43fc4da2aecdf52d6cdb1",
      "new_mode": 33188,
      "new_path": "src/hb-ot-layout-gsubgpos.hh"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "de95c8528723260850eea2da6488f2b37388eea2",
      "new_mode": 33188,
      "new_path": "test/fuzzing/fonts/3653331f3f13ff5b1b271c5c5583ace4c757005c"
    }
  ]
}