Fix woff2_compress fuzzer bugs
This commit is contained in:
@@ -123,6 +123,9 @@ bool ReadCollectionFont(Buffer* file, const uint8_t* data, size_t len,
|
|||||||
(*all_tables)[table.offset] = font->FindTable(table.tag);
|
(*all_tables)[table.offset] = font->FindTable(table.tag);
|
||||||
} else {
|
} else {
|
||||||
table.reuse_of = (*all_tables)[table.offset];
|
table.reuse_of = (*all_tables)[table.offset];
|
||||||
|
if (table.tag != table.reuse_of->tag) {
|
||||||
|
return FONT_COMPRESSION_FAILURE();
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
+4
-1
@@ -96,7 +96,10 @@ bool MakeEditableBuffer(Font* font, int tableTag) {
|
|||||||
int sz = Round4(table->length);
|
int sz = Round4(table->length);
|
||||||
table->buffer.resize(sz);
|
table->buffer.resize(sz);
|
||||||
uint8_t* buf = &table->buffer[0];
|
uint8_t* buf = &table->buffer[0];
|
||||||
memcpy(buf, table->data, sz);
|
memcpy(buf, table->data, table->length);
|
||||||
|
if (PREDICT_FALSE(sz > table->length)) {
|
||||||
|
memset(buf + table->length, 0, sz - table->length);
|
||||||
|
}
|
||||||
table->data = buf;
|
table->data = buf;
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user