diff --git a/.gitignore b/.gitignore index dc6b1e2..e327693 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ *.o +*.a /woff2_compress /woff2_decompress diff --git a/Makefile b/Makefile index 9642c75..4f2c271 100644 --- a/Makefile +++ b/Makefile @@ -2,10 +2,13 @@ OS := $(shell uname) CPPFLAGS = -I./brotli/include/ -I./src +AR ?= ar CC ?= gcc CXX ?= g++ -COMMON_FLAGS = -fno-omit-frame-pointer -no-canonical-prefixes -DFONT_COMPRESSION_BIN -D __STDC_FORMAT_MACROS +# It's helpful to be able to turn this off for fuzzing +CANONICAL_PREFIXES ?= -no-canonical-prefixes +COMMON_FLAGS = -fno-omit-frame-pointer $(CANONICAL_PREFIXES) -DFONT_COMPRESSION_BIN -D __STDC_FORMAT_MACROS ifeq ($(OS), Darwin) CPPFLAGS += -DOS_MACOSX @@ -13,6 +16,7 @@ else COMMON_FLAGS += -fno-tree-vrp endif +ARFLAGS = crf CFLAGS += $(COMMON_FLAGS) CXXFLAGS += $(COMMON_FLAGS) -std=c++11 @@ -30,14 +34,18 @@ COMMONOBJ = $(BROTLIOBJ)/common/*.o OBJS = $(patsubst %, $(SRCDIR)/%, $(OUROBJ)) EXECUTABLES=woff2_compress woff2_decompress - EXE_OBJS=$(patsubst %, $(SRCDIR)/%.o, $(EXECUTABLES)) +ARCHIVES=convert_woff2ttf_fuzzer convert_woff2ttf_fuzzer_new_entry +ARCHIVE_OBJS=$(patsubst %, $(SRCDIR)/%.o, $(ARCHIVES)) ifeq (,$(wildcard $(BROTLI)/*)) $(error Brotli dependency not found : you must initialize the Git submodule) endif -all : $(OBJS) $(EXECUTABLES) +all : $(OBJS) $(EXECUTABLES) $(ARCHIVES) + +$(ARCHIVES) : $(ARCHIVE_OBJS) $(OBJS) deps + $(AR) $(ARFLAGS) $(SRCDIR)/$@.a $(OBJS) $(ENCOBJ) $(DECOBJ) $(SRCDIR)/$@.o $(EXECUTABLES) : $(EXE_OBJS) deps $(CXX) $(LFLAGS) $(OBJS) $(COMMONOBJ) $(ENCOBJ) $(DECOBJ) $(SRCDIR)/$@.o -o $@ diff --git a/src/buffer.h b/src/buffer.h index 588ac0d..08681a6 100644 --- a/src/buffer.h +++ b/src/buffer.h @@ -65,8 +65,8 @@ inline bool Failure(const char *f, int l, const char *fn) { // ----------------------------------------------------------------------------- class Buffer { public: - Buffer(const uint8_t *buffer, size_t len) - : buffer_(buffer), + Buffer(const uint8_t *data, size_t len) + : buffer_(data), length_(len), offset_(0) { } @@ -74,7 +74,7 @@ class Buffer { return Read(NULL, n_bytes); } - bool Read(uint8_t *buffer, size_t n_bytes) { + bool Read(uint8_t *data, size_t n_bytes) { if (n_bytes > 1024 * 1024 * 1024) { return FONT_COMPRESSION_FAILURE(); } @@ -82,8 +82,8 @@ class Buffer { (offset_ > length_ - n_bytes)) { return FONT_COMPRESSION_FAILURE(); } - if (buffer) { - std::memcpy(buffer, buffer_ + offset_, n_bytes); + if (data) { + std::memcpy(data, buffer_ + offset_, n_bytes); } offset_ += n_bytes; return true; diff --git a/src/convert_woff2ttf_fuzzer.cc b/src/convert_woff2ttf_fuzzer.cc new file mode 100644 index 0000000..3fdd15b --- /dev/null +++ b/src/convert_woff2ttf_fuzzer.cc @@ -0,0 +1,13 @@ +#include +#include + +#include "woff2_dec.h" + +// Entry point for LibFuzzer. +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { + std::string buf; + woff2::WOFF2StringOut out(&buf); + out.SetMaxSize(30 * 1024 * 1024); + woff2::ConvertWOFF2ToTTF(data, size, &out); + return 0; +} diff --git a/src/convert_woff2ttf_fuzzer_new_entry.cc b/src/convert_woff2ttf_fuzzer_new_entry.cc new file mode 100644 index 0000000..75114a9 --- /dev/null +++ b/src/convert_woff2ttf_fuzzer_new_entry.cc @@ -0,0 +1,12 @@ +#include +#include "woff2_dec.h" + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t data_size) { + // Decode using newer entry pattern. + // Same pattern as woff2_decompress. + std::string output(std::min(woff2::ComputeWOFF2FinalSize(data, data_size), + woff2::kDefaultMaxSize), 0); + woff2::WOFF2StringOut out(&output); + woff2::ConvertWOFF2ToTTF(data, data_size, &out); + return 0; +} diff --git a/src/font.cc b/src/font.cc index 0606730..fc496e0 100644 --- a/src/font.cc +++ b/src/font.cc @@ -105,6 +105,12 @@ bool ReadTrueTypeFont(Buffer* file, const uint8_t* data, size_t len, last_offset = i.first + i.second; } + // Sanity check key tables + const Font::Table* head_table = font->FindTable(kHeadTableTag); + if (head_table != NULL && head_table->length < 52) { + return FONT_COMPRESSION_FAILURE(); + } + return true; } diff --git a/src/glyph.cc b/src/glyph.cc index 1dadafc..4c6b60a 100644 --- a/src/glyph.cc +++ b/src/glyph.cc @@ -118,25 +118,27 @@ bool ReadGlyph(const uint8_t* data, size_t len, Glyph* glyph) { // Read the run-length coded flags. std::vector > flags(num_contours); - uint8_t flag = 0; - uint8_t flag_repeat = 0; - for (int i = 0; i < num_contours; ++i) { - flags[i].resize(glyph->contours[i].size()); - for (size_t j = 0; j < glyph->contours[i].size(); ++j) { - if (flag_repeat == 0) { - if (!buffer.ReadU8(&flag)) { - return FONT_COMPRESSION_FAILURE(); - } - if (flag & kFLAG_REPEAT) { - if (!buffer.ReadU8(&flag_repeat)) { + { + uint8_t flag = 0; + uint8_t flag_repeat = 0; + for (int i = 0; i < num_contours; ++i) { + flags[i].resize(glyph->contours[i].size()); + for (size_t j = 0; j < glyph->contours[i].size(); ++j) { + if (flag_repeat == 0) { + if (!buffer.ReadU8(&flag)) { return FONT_COMPRESSION_FAILURE(); } + if (flag & kFLAG_REPEAT) { + if (!buffer.ReadU8(&flag_repeat)) { + return FONT_COMPRESSION_FAILURE(); + } + } + } else { + flag_repeat--; } - } else { - flag_repeat--; + flags[i][j] = flag; + glyph->contours[i][j].on_curve = flag & kFLAG_ONCURVE; } - flags[i][j] = flag; - glyph->contours[i][j].on_curve = flag & kFLAG_ONCURVE; } } diff --git a/src/variable_length.cc b/src/variable_length.cc index 944a17f..264eb0a 100644 --- a/src/variable_length.cc +++ b/src/variable_length.cc @@ -49,8 +49,8 @@ void Write255UShort(std::vector* out, int value) { void Store255UShort(int val, size_t* offset, uint8_t* dst) { std::vector packed; Write255UShort(&packed, val); - for (uint8_t val : packed) { - dst[(*offset)++] = val; + for (uint8_t packed_byte : packed) { + dst[(*offset)++] = packed_byte; } }