tree e14c0a3525167bbe99666fc4cdfbc47e4936f5f8
parent 8339a9b480291103fe5a8d030e25f90a8dca1069
parent 331ef99cd8b2b0a36ea256cfb082b64f19a2196f
author Behdad Esfahbod <behdad@behdad.org> 1773154544 -0600
committer GitHub <noreply@github.com> 1773154544 -0600
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJpsDDwCRC1aQ7uu5UhlAAAf3UQAA1lYhdzAkEdT2hensID7wLX
 8dP48RiOT8zxTKCyCLN85BW1Lu34D4rPmba9u8rdF1X2+EaVjVNGeH3l03Yenx/Y
 1fFPT+osQts+LFFUZxae+bFNNM12sQqvzW2X2TMBbUmNCDVIYZMAX+WlpZ8z6AFB
 X5pWcVNDQFtO7ksJ6xtYKfHPa5TGsxpdpRDbOxgbx296bNlt/8vG6XWrFV8s93yt
 TY9UHAb7c8JPBIDDO4Fp9/ZhSofmYKZGLbLZXtwvn9L+AjZxGgTpxGIzn7EDZXbn
 PA7DJTiGNsxq+oZHhGrNU4u2mToycm2PZNnm6YmMkUbX7ir6zSqlHeYFDnd6aShn
 moeN4TKgWghwJvp2c+LK8RaMJiwG/I2YWAkFF/KZwFBHzLHrPYudJwxX0RYySqwk
 SC0Za82wt5aH84LrYx6KX0LYVgmMosZ1nkWli1kd9NK63SX01xsxAWQpe9W4TOg1
 BBRHzZU7tTg2eVZ1p/Cz50AMnYO53bcCSTALRtT5pkIo+dFB9t6YeP0bsLJIIZS7
 hDdNsk/rWkHWaOSqNummCieA6CXRDdFeYv0kh16dHMhYCbZ/5ihFjB8G1rtgnft0
 3C7tyVfAuDS2FUfEhzraXEnGDiKu4wrn9JuQ4QeAQr3E3/W2yDYjXUzYrKvzXzd/
 KmGZneNNUc7P1Fiinejq
 =GSf3
 -----END PGP SIGNATURE-----
 

[fuzzing] Fix hb-raster/vector fuzzer issues (#5816)

* [fuzzing] Guard raster/vector create_or_fail results

The raster and vector fuzzers called create_or_fail() and then
immediately dereferenced the returned pointers. Under CIFuzz's
allocation-failure coverage, that turns a valid NULL return into a
harness crash instead of treating it as an out-of-memory case.

Return early after cleaning up when draw or paint context creation
fails. This keeps the fuzzers aligned with the create_or_fail()
contract and avoids null-deref crashes unrelated to library logic.

Tested:
- meson compile -C build hb-raster-fuzzer hb-vector-fuzzer
- build/test/fuzzing/hb-vector-fuzzer test/fuzzing/fonts/TwemojiMozilla.subset.ttf
- build/test/fuzzing/hb-raster-fuzzer test/fuzzing/fonts/TwemojiMozilla.subset.ttf

Assisted-by: OpenAI Codex

* [vector] Avoid OOM leak in paint initialization

hb_vector_paint_ensure_initialized() used group_stack.push() and
then treated the returned pointer as a normal success indicator.
On allocation failure push() returns the Crap() sentinel, so the
subsequent root->alloc(4096) allocated backing storage into the
failure sink and leaked under malloc-failure fuzzing.

Use push_or_fail() instead and only allocate the root body after a
real push succeeds.

Tested:
- build/test/fuzzing/hb-vector-fuzzer test/fuzzing/fonts/TwemojiMozilla.subset.ttf

Assisted-by: OpenAI Codex

* [vector] Avoid double-free on blob creation failure

hb_svg_blob_from_buffer() handed buffer ownership to hb_blob_create()
in the non-recycled path and then ran its own failure cleanup. When
hb_blob_create() failed, it had already invoked the destroy callback,
so the local cleanup freed the same buffer again.

Use hb_blob_create_or_fail() there instead so allocation failure
returns nullptr without triggering the empty-blob fallback and its
conflicting cleanup semantics.

Tested:
- meson compile -C build hb-vector-fuzzer

Assisted-by: OpenAI Codex

* [vector] Avoid double-free in draw blob creation

Mirror the blob-creation failure fix from vector paint in the SVG
draw path. The non-recycled branch handed ownership to
hb_blob_create(), which may already run the destroy callback on
failure, and then fell into local cleanup that freed the same buffer
again.

Switch that branch to hb_blob_create_or_fail() so failure reports
nullptr without conflicting cleanup.

Tested:
- meson compile -C build hb-vector-fuzzer

Assisted-by: OpenAI Codex

* [vector] Fix OOM handling in SVG subset id collection

hb_svg_add_unique_id() used v->push() and tested the returned
pointer for null. hb_vector_t::push() reports allocation failure via
the vector error state and returns the Crap() sentinel, so the old
check did not reliably stop on OOM.

Check v->in_error() after push() before writing into the new slot.

Assisted-by: OpenAI Codex

* [vector] Guard paint render after init failure

hb_vector_paint_render() assumed ensure_initialized() had created
the root group body and indexed group_stack[0] unconditionally.
Under malloc-failure fuzzing, initialization can fail while extents
are already set, leaving group_stack empty and causing a null-deref.

Return nullptr if initialization did not produce the root group.

Assisted-by: OpenAI Codex

* [vector] Propagate paint init failures

hb_vector_paint_ensure_initialized() can fail under malloc-failure
fuzzing, but several paint callbacks assumed the root group existed
immediately afterward and accessed current_body() or group_stack[0].

Make initialization report success and bail out at the callers that
require the root group. Also use push_or_fail() for the extra group
stack entries created by grouping and glyph caching.

Assisted-by: OpenAI Codex

* [raster] Bound SVG path parsing work

hb_raster_svg_parse_path_data() had no complexity cap, unlike the
other new raster SVG subsystems that already bound recursion depth,
attribute count, and gradient stops. Malformed path data could
therefore spend excessive time in parsing and bbox/render work under
fuzzing.

Add a hard limit on parsed path segments and expose it through
hb-limits.hh so the budget is defined alongside the other shared
parser/work limits.

Assisted-by: OpenAI Codex

* [raster] Bound temporary clip mask buffers

hb_raster_paint_push_clip_from_emitter() and the general clip
rectangle path could allocate and clear full-surface temporary A8 clip
masks with no explicit size cap, leading to timeout-scale work on
malformed inputs.

Reuse the raster buffer size policy for these temporary masks as well,
and move that limit into hb-limits.hh so raster images and clip masks
share the same bound.

Assisted-by: OpenAI Codex

* [raster] Reduce buffer size cap

Lower HB_RASTER_MAX_BUFFER_SIZE from 1<<30 to 1<<24 so the shared
raster image / clip-mask limit meaningfully constrains pathological
fuzzer inputs instead of allowing timeout-scale temporary buffers.

Assisted-by: OpenAI Codex