Skip to content

Commit

Permalink
[GPOS] Fix assert fail introduced recently
Browse files Browse the repository at this point in the history
Was introduced in 8708b9e.

If these lookups are recursed to from (Chain)Context out-of-order,
it was possible that last_base > buffer->idx, in which case we
were attaching marks to a base after them... and an assertion
was failing fortunately.

Fixes https://oss-fuzz.com/testcase-detail/6377756666757120
  • Loading branch information
behdad committed Feb 7, 2023
1 parent 840e1b6 commit 64fa5cd
Show file tree
Hide file tree
Showing 3 changed files with 10 additions and 0 deletions.
5 changes: 5 additions & 0 deletions src/OT/Layout/GPOS/MarkBasePosFormat1.hh
Expand Up @@ -122,6 +122,11 @@ struct MarkBasePosFormat1_2
hb_ot_apply_context_t::skipping_iterator_t &skippy_iter = c->iter_input;
skippy_iter.set_lookup_props (LookupFlag::IgnoreMarks);

if (c->last_base_until > buffer->idx)
{
c->last_base_until = 0;
c->last_base = -1;
}
unsigned j;
for (j = buffer->idx; j > c->last_base_until; j--)
{
Expand Down
5 changes: 5 additions & 0 deletions src/OT/Layout/GPOS/MarkLigPosFormat1.hh
Expand Up @@ -104,6 +104,11 @@ struct MarkLigPosFormat1_2
hb_ot_apply_context_t::skipping_iterator_t &skippy_iter = c->iter_input;
skippy_iter.set_lookup_props (LookupFlag::IgnoreMarks);

if (c->last_base_until > buffer->idx)
{
c->last_base_until = 0;
c->last_base = -1;
}
unsigned j;
for (j = buffer->idx; j > c->last_base_until; j--)
{
Expand Down
Binary file not shown.

0 comments on commit 64fa5cd

Please sign in to comment.