[repacker] fix potential use after free in repacker. During table splitting we iterate over the lookups map which can be modified during table splitting. This can result in a use after free in the iterator. Create a local copy of the lookup indices to avoid this.
diff --git a/src/hb-repacker.hh b/src/hb-repacker.hh index e304225..e9cd376 100644 --- a/src/hb-repacker.hh +++ b/src/hb-repacker.hh
@@ -79,7 +79,12 @@ // pass after this processing is done. Not super necessary as splits are // only done where overflow is likely, so de-dup probably will get undone // later anyways. - for (unsigned lookup_index : ext_context.lookups.keys ()) + + // The loop below can modify the contents of ext_context.lookups if new subtables are added + // to a lookup during a split. So save the initial set of lookup indices so the iteration doesn't + // risk access free'd memory if ext_context.lookups gets resized. + hb_set_t lookup_indices(ext_context.lookups.keys ()); + for (unsigned lookup_index : lookup_indices) { graph::Lookup* lookup = ext_context.lookups.get(lookup_index); if (!lookup->split_subtables_if_needed (ext_context, lookup_index))