Avoid buffer->move_to() in case of buffer error
Fixes https://github.com/behdad/harfbuzz/issues/223
Right now we cannot test this because it has to be tested using hb-fuzzer.
We should move all fuzzing tests from test/shaping/tests/fuzzed.tests to
test/fuzzing/ and have its own test runner. At that point, should add
test from this issue as well.
diff --git a/src/hb-buffer.cc b/src/hb-buffer.cc
index c731ed1..5f320bd 100644
--- a/src/hb-buffer.cc
+++ b/src/hb-buffer.cc
@@ -407,6 +407,8 @@
idx = i;
return true;
}
+ if (unlikely (in_error))
+ return false;
assert (i <= out_len + (len - idx));
diff --git a/src/hb-ot-layout-gsubgpos-private.hh b/src/hb-ot-layout-gsubgpos-private.hh
index d6db005..3f9d9ca 100644
--- a/src/hb-ot-layout-gsubgpos-private.hh
+++ b/src/hb-ot-layout-gsubgpos-private.hh
@@ -971,7 +971,7 @@
match_positions[j] += delta;
}
- for (unsigned int i = 0; i < lookupCount; i++)
+ for (unsigned int i = 0; i < lookupCount && !buffer->in_error; i++)
{
unsigned int idx = lookupRecord[i].sequenceIndex;
if (idx >= count)
