src/hb-aat-layout-common.hh | 4 ++-- src/hb-open-type.hh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
New commits: commit 2c824d3644e16643c2bbe85fb88f9fb6fed53ce7 Author: Behdad Esfahbod <[email protected]> Date: Thu Oct 11 16:41:01 2018 -0400 [aat] Fix two wrongs that made a right before! Unfortunately our static asserts (DEFINE_SIZE_STATIC) don't actually fail when used in templates, thanks to SFINAE. Le sighs. Probably fixes https://oss-fuzz.com/v2/testcase-detail/5740171484463104 diff --git a/src/hb-aat-layout-common.hh b/src/hb-aat-layout-common.hh index 5be3d372..4e3e4d17 100644 --- a/src/hb-aat-layout-common.hh +++ b/src/hb-aat-layout-common.hh @@ -164,7 +164,7 @@ struct LookupFormat4 } protected: - HBUINT16 format; /* Format identifier--format = 2 */ + HBUINT16 format; /* Format identifier--format = 4 */ VarSizedBinSearchArrayOf<LookupSegmentArray<T> > segments; /* The actual segments. These must already be sorted, * according to the first word in each one (the last @@ -187,7 +187,7 @@ struct LookupSingle GlyphID glyph; /* Last GlyphID */ T value; /* The lookup value (only one) */ public: - DEFINE_SIZE_STATIC (4 + T::static_size); + DEFINE_SIZE_STATIC (2 + T::static_size); }; template <typename T> diff --git a/src/hb-open-type.hh b/src/hb-open-type.hh index 2eae09d5..0aea6423 100644 --- a/src/hb-open-type.hh +++ b/src/hb-open-type.hh @@ -833,7 +833,7 @@ struct VarSizedBinSearchArrayOf { TRACE_SANITIZE (this); return_trace (header.sanitize (c) && - Type::static_size >= header.unitSize && + Type::static_size <= header.unitSize && c->check_array (bytesZ.arrayZ, header.nUnits, header.unitSize)); } _______________________________________________ HarfBuzz mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/harfbuzz
