tree 1d73572964059c100d3512a2f86ee166e68aa93d
parent 27f1be922e56633526e4b963b69b2a60628b258d
author parasol-aser <3848358+parasol-aser@users.noreply.github.com> 1776563694 -0500
committer GitHub <noreply@github.com> 1776563694 -0600
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJp5DXuCRC1aQ7uu5UhlAAAEvAQAKFALisOZBJ1kk/JNx0AbAqq
 QRXIE3QjYUvtCDF4cSWQr8u6HOFdq5/ba/rqdonvjhB42uv5vivWQTE7Rqt9Gc8J
 hP2eVumjdHO5a+4L5BTGXYMPqyvxnH1eekCSJRxIJDarAPSlSgQERaxdO62STJ9e
 e6oQaBgBBipGlMQaA6LJA9VwqaMnqNk1QUhtbfisZCXdTKRRwLaERZSFzAHxT/g0
 0Ocll7Tl3ZEYV5aN2m9uKnI55qtRNpCv8SRHGdz2We+4WeJVYI2ma4rGfbNzlDON
 hHjYSiYIXggw5vn6/82PlZeQBP7E7Hfult9LRrnU0SctmUPGdgm7SL3cq6SnVg5A
 XwkH8VnrFIov8Shc0a5qo3ysGg1Kc4fT/4ZtzGQvYP4Cl3jMwWioVAK7D+oIAu6X
 Cvp3HbYMGWDXYSdf73UkquHoNUK53hRdKqCAvlldsLPAJziPncY6G8yhIaiXL08g
 GTw54V7ytJvVEgSsttEuvhjM2tlOWuUipp5zGof9jyOI3+BwRyGE5oHXVfc1sVrp
 p5iB5yp8MZTFO9CmCzzyHhRiOeD7jshvPm2XKsWPdQVcCyJXLZ5RXyepNafg18Xt
 dAPnUyPbKSCxXPmvx8C3e40nEMlodZfCcdx9jr5fMj7jRZD23qQEYxj9kZyTOLRT
 zw2NmPpk7oVWITO08WbZ
 =oKq0
 -----END PGP SIGNATURE-----
 

[fontations] Fix OOB write on glyph-name callback with size == 0 (#5946) (#5947)

* [fontations] Fix OOB write on glyph-name callback with size == 0

The Rust `_hb_fontations_glyph_name()` callback computed
`glyph_name.len().min(size as usize - 1)`. When a caller passed
`size == 0`, `size as usize - 1` underflowed a `usize` to
`usize::MAX`, the `min()` clamp collapsed to `glyph_name.len()`,
and the subsequent `copy_nonoverlapping` / trailing NUL wrote
`glyph_name.len() + 1` bytes into a zero-capacity caller buffer.
This is an out-of-bounds write reachable from the public API
whenever the build was configured with `-Dfontations=enabled`
and the application had called `hb_fontations_font_set_funcs()`.

Short-circuit the `size == 0` case before the subtraction.
Return `true` in that case to match the existing post and CFF1
backends (`hb-ot-post-table.hh`, `hb-ot-cff1-table.hh`), which
both early-out with `return true` on `!buf_len` — the glyph
does have a name; we simply had no buffer to write it into.

Regression tests added in `test/api/test-glyph-names.c` cover
the zero-size path on post and CFF1 backends, a sub-font, a
NULL buffer, and `size == 1` / small-buffer / exact-fit cases
so the truncation path does not silently regress.

Fixes: https://github.com/harfbuzz/harfbuzz/issues/5946
Assisted-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [font] Reject glyph-name lookups with size == 0 at the wrapper

`hb_font_t::get_glyph_name()` previously pre-wrote the trailing
NUL only when `size != 0` but still dispatched to the backend
callback with `size == 0`. Every current glyph-name backend has
to re-validate that argument: `post` and `cff1` short-circuit
with `return true`, the new Rust `fontations` callback now
short-circuits too (prior commit), and the CoreText callback in
`hb-coretext-font.cc` has a structurally similar `(CFIndex)size
- 1` pattern.

Normalize this at the wrapper layer: return `false` immediately
on `size == 0`, before any backend dispatch and before the
`*name = '\0'` write. This makes the zero-size case a single,
auditable no-op for every glyph-name provider (native or Rust,
current or future) and removes the CoreText underflow from the
reachable surface through the same chokepoint.

Observable change: callers that invoked
`hb_font_get_glyph_name(font, gid, buf, 0)` on post/cff1 backed
fonts used to get `true` back; they now get `false`. `size == 0`
queries carry no useful information for the caller, so this is
considered a safe hardening rather than a contract break.

Assisted-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [font] Preserve glyph-name zero-size probe semantics

Keep `hb_font_get_glyph_name(..., NULL, 0)` as a valid
return-value-only probe instead of rejecting `size == 0` in the
wrapper.

Fix the remaining backend-specific zero-size paths in hb-ft and
hb-coretext-font so they answer the probe without dereferencing the
caller buffer, and update the API tests to assert the preserved
behavior.

Testing: CCACHE_DISABLE=1 meson test -C build test-glyph-names
Testing: CCACHE_DISABLE=1 meson test -C build test-ft
Assisted-by: OpenAI Codex <codex@openai.com>

---------

Co-authored-by: jeffhuang <jeff@docker.xydrsucermoubd24xgo33yhsgd.bx.internal.cloudapp.net>