)]}'
{
  "commit": "d75c58a2e4c87903780a75a102cba4df93c5fedc",
  "tree": "f7ca820a7e94f29db5004dae58a0b96bbb902199",
  "parents": [
    "9072836ef5794d314734854bb61c856b437ac3b8"
  ],
  "author": {
    "name": "Behdad Esfahbod",
    "email": "behdad@behdad.org",
    "time": "Wed Jul 08 00:28:35 2026 -0600"
  },
  "committer": {
    "name": "Behdad Esfahbod",
    "email": "behdad@behdad.org",
    "time": "Wed Jul 08 00:28:35 2026 -0600"
  },
  "message": "[ot] Fix NULL-deref when nullable output arrays are passed to list getters\n\nSeveral public \"list getter\" APIs document their output array as nullable\n(pass NULL to just query the total count without storing anything), but\ntheir implementations gated the copy only on the count pointer:\n\n    if (count)\n    {\n      + source.sub_array (start_offset, count)\n      | hb_sink (hb_array (out, *count));   // writes through out even if NULL\n    }\n\nPassing a non-NULL count with a NULL output array on a populated table\ntherefore wrote through the NULL pointer and crashed (SIGSEGV).\n\nGate each copy on the output pointer as well (the same idiom already used\nby hb_color_line_get_color_stops: \"if (count \u0026\u0026 out)\").  This is a no-op\nwhen the output array is non-NULL and restores the documented behaviour of\nreturning the total count when it is NULL.  Affected getters:\n\n  - hb_ot_color_palette_get_colors            (CPAL)\n  - hb_ot_color_glyph_get_layers              (COLR v0)\n  - hb_ot_meta_get_entry_tags                 (meta)\n  - hb_aat_layout_get_feature_types           (AAT feat)\n  - hb_aat_layout_feature_type_get_selector_infos (AAT feat)\n  - hb_ot_layout_feature_get_characters       (GSUB cvXX)\n  - hb_ot_layout_lookup_get_glyph_alternates  (GSUB aalt)\n\nAdd test/api/test-ot-nullable-output.c exercising each route with a NULL\noutput array; every case crashed before this change.\n\nFixes: GHSA-v5mv-8hhw-vff8\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "dd1dbd15d0bdec7154c7b2e9542349937bb0b377",
      "old_mode": 33188,
      "old_path": "src/OT/Color/COLR/COLR.hh",
      "new_id": "39a8231ba8da784a8bc218b50ce1cfa1b1193d76",
      "new_mode": 33188,
      "new_path": "src/OT/Color/COLR/COLR.hh"
    },
    {
      "type": "modify",
      "old_id": "9364fd93956e93555670933e107d729e853f9732",
      "old_mode": 33188,
      "old_path": "src/OT/Color/CPAL/CPAL.hh",
      "new_id": "ade2c1f863bccb3ab06f7e868f7725c943a3b28b",
      "new_mode": 33188,
      "new_path": "src/OT/Color/CPAL/CPAL.hh"
    },
    {
      "type": "modify",
      "old_id": "0437cff463b25c8b1ccca1d25497eb33ba13ee4a",
      "old_mode": 33188,
      "old_path": "src/OT/Layout/GSUB/AlternateSet.hh",
      "new_id": "24883580aede320064613c8b32b126179eba165b",
      "new_mode": 33188,
      "new_path": "src/OT/Layout/GSUB/AlternateSet.hh"
    },
    {
      "type": "modify",
      "old_id": "4fbec332eb7ddc1a4882456a3141a658f7cc2fbe",
      "old_mode": 33188,
      "old_path": "src/hb-aat-layout-feat-table.hh",
      "new_id": "2f02de338d44524bdb61d6dafc9236bcc055f96f",
      "new_mode": 33188,
      "new_path": "src/hb-aat-layout-feat-table.hh"
    },
    {
      "type": "modify",
      "old_id": "09326dac38635a8cd491b2b30d4e04daad0640d0",
      "old_mode": 33188,
      "old_path": "src/hb-ot-layout-common.hh",
      "new_id": "17f5990a43e364b8f88efc72450a734bd311d106",
      "new_mode": 33188,
      "new_path": "src/hb-ot-layout-common.hh"
    },
    {
      "type": "modify",
      "old_id": "658db584c7d369e644cc9e8cbecd1bcb71541d2d",
      "old_mode": 33188,
      "old_path": "src/hb-ot-meta-table.hh",
      "new_id": "5365774de7d19ac4f0096f23e048937124f7b502",
      "new_mode": 33188,
      "new_path": "src/hb-ot-meta-table.hh"
    },
    {
      "type": "modify",
      "old_id": "51d0a016baff841103bc2439302861d5d99a802c",
      "old_mode": 33188,
      "old_path": "test/api/meson.build",
      "new_id": "7e91fa006b13ff5f70093eb057f14f04559d7e99",
      "new_mode": 33188,
      "new_path": "test/api/meson.build"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "56e6813007886a06ac0a95fa40058423d03224f3",
      "new_mode": 33188,
      "new_path": "test/api/test-ot-nullable-output.c"
    }
  ]
}