Skip to content

UBSan: index out of bounds for type 'OT::LongMetric const[1]' #761

@tysmith

Description

@tysmith

Found with commit 8cb8bfd using hb-fuzzer + UBSan

hb-ot-hmtx-table.hh:146:14: runtime error: index 48 out of bounds for type 'OT::LongMetric const[1]'
#0 0x56fdda in OT::hmtxvmtxOT::hmtx::accelerator_t::get_advance(unsigned int, hb_font_t*) const /src/./hb-ot-hmtx-table.hh:146:74
#1 0x558dc4 in hb_ot_get_glyph_h_advance(hb_font_t*, void*, unsigned int, void*) /src/hb-ot-font.cc:120:47
#2 0x635c0a in hb_ot_position_default(hb_ot_shape_context_t*) /src/hb-ot-shape.cc:676:35
#3 0x635c0a in hb_ot_position(hb_ot_shape_context_t*) /src/hb-ot-shape.cc:774
#4 0x635c0a in hb_ot_shape_internal(hb_ot_shape_context_t*) /src/hb-ot-shape.cc:860
#5 0x631e3d in _hb_ot_shape /src/hb-ot-shape.cc:887:3
#6 0x550059 in hb_shape_plan_execute /src/./hb-shaper-list.hh:43:1
#7 0x54e6f1 in hb_shape_full /src/hb-shape.cc:132:19
#8 0x510b56 in LLVMFuzzerTestOneInput /test/fuzzing/hb-fuzzer.cc:30:5
#9 0x5117e7 in main /test/fuzzing/main.cc:20:4
#10 0x7f71968b682f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#11 0x41a948 in _start (hb-fuzzer+0x41a948)

test.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions