)]}'
{
  "commit": "7052cd343ed0f8ce8bdbf2d72a0bc8030e2b734b",
  "tree": "1cc6546e5d1ad47f9514c7e983a09e7f8dcca25c",
  "parents": [
    "a439a61f8faefbb4074494ee126774f8a5aafddc"
  ],
  "author": {
    "name": "Behdad Esfahbod",
    "email": "behdad@behdad.org",
    "time": "Wed Jul 08 00:46:20 2026 -0600"
  },
  "committer": {
    "name": "Behdad Esfahbod",
    "email": "behdad@behdad.org",
    "time": "Wed Jul 08 00:46:20 2026 -0600"
  },
  "message": "[GSUB] Fix NULL-deref in SingleSubst get_glyph_alternates\n\nhb_ot_layout_lookup_get_glyph_alternates() documents its alternate_glyphs\noutput as nullable, and the AlternateSubst path was fixed in the previous\ncommit.  The Single-substitution fallback paths (SingleSubstFormat1 and\nSingleSubstFormat2, used when the queried lookup is a single-substitution)\nhad the same defect: they gated the write on\n\n    if (alternate_count \u0026\u0026 *alternate_count)\n\nand then did *alternate_glyphs \u003d glyph_id without checking alternate_glyphs.\nPassing a NULL alternate_glyphs with a non-NULL, non-zero count on a covered\nglyph therefore wrote through NULL and crashed.\n\nAlso require alternate_glyphs to be non-NULL before storing.\n\nFixes: GHSA-v5mv-8hhw-vff8\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "1cd3f9d9cdff8e3b75628ff2928c73451c7ea305",
      "old_mode": 33188,
      "old_path": "src/OT/Layout/GSUB/SingleSubstFormat1.hh",
      "new_id": "2c2733d4c9bcebbdc31b3e785da7b55dc3137c6f",
      "new_mode": 33188,
      "new_path": "src/OT/Layout/GSUB/SingleSubstFormat1.hh"
    },
    {
      "type": "modify",
      "old_id": "4c98f05aebaca6a502e3f9aa8701adb2ee61e306",
      "old_mode": 33188,
      "old_path": "src/OT/Layout/GSUB/SingleSubstFormat2.hh",
      "new_id": "8e6df7d631cf6d5524b6f381aca10d21b2130ed9",
      "new_mode": 33188,
      "new_path": "src/OT/Layout/GSUB/SingleSubstFormat2.hh"
    }
  ]
}