commit 8aaab78efcac81a05ec919be13792c98741ea1b5
author Ebrahim Byagowi <ebrahim@gnu.org> Thu Mar 14 16:49:42 2019 -0700
committer GitHub <noreply@github.com> Thu Mar 14 16:49:42 2019 -0700
tree 33a797d34717568f634f77e5582233fcb24fa790
parent b1dfb8c850f36d4065190a779a6e3342a5fbb593

Allow zero length ranges in sanitization (#1617)

Fixes fvar table sanitization where there are no named instance
by allowing zero length ranges starting from Null() address.

Fixes #1607

src/hb-machinery.hh

diff --git a/src/hb-machinery.hh b/src/hb-machinery.hh
index b22c238..ffa423d 100644
--- a/src/hb-machinery.hh
+++ b/src/hb-machinery.hh
@@ -326,27 +326,29 @@
   }
 
   bool check_range (const void *base,
-			   unsigned int len) const
+		    unsigned int len) const
   {
     const char *p = (const char *) base;
-    bool ok = this->start <= p &&
-	      p <= this->end &&
-	      (unsigned int) (this->end - p) >= len &&
-	      this->max_ops-- > 0;
+    bool ok = !len ||
+	      (this->start <= p &&
+	       p <= this->end &&
+	       (unsigned int) (this->end - p) >= len &&
+	       this->max_ops-- > 0);
 
     DEBUG_MSG_LEVEL (SANITIZE, p, this->debug_depth+1, 0,
-       "check_range [%p..%p] (%d bytes) in [%p..%p] -> %s",
-       p, p + len, len,
-       this->start, this->end,
-       ok ? "OK" : "OUT-OF-RANGE");
+		     "check_range [%p..%p]"
+		     " (%d bytes) in [%p..%p] -> %s",
+		     p, p + len, len,
+		     this->start, this->end,
+		     ok ? "OK" : "OUT-OF-RANGE");
 
     return likely (ok);
   }
 
   template <typename T>
   bool check_range (const T *base,
-			   unsigned int a,
-			   unsigned int b) const
+		    unsigned int a,
+		    unsigned int b) const
   {
     return !hb_unsigned_mul_overflows (a, b) &&
 	   this->check_range (base, a * b);
@@ -354,9 +356,9 @@
 
   template <typename T>
   bool check_range (const T *base,
-			   unsigned int a,
-			   unsigned int b,
-			   unsigned int c) const
+		    unsigned int a,
+		    unsigned int b,
+		    unsigned int c) const
   {
     return !hb_unsigned_mul_overflows (a, b) &&
 	   this->check_range (base, a * b, c);

test/api/fonts/Zycon.ttf

diff --git a/test/api/fonts/Zycon.ttf b/test/api/fonts/Zycon.ttf
new file mode 100644
index 0000000..3a6761b
--- /dev/null
+++ b/test/api/fonts/Zycon.ttf
Binary files differ

test/api/test-ot-face.c

diff --git a/test/api/test-ot-face.c b/test/api/test-ot-face.c
index f2d2fca..9ebcb4e 100644
--- a/test/api/test-ot-face.c
+++ b/test/api/test-ot-face.c
@@ -110,12 +110,21 @@
   test_face (hb_face_get_empty (), 0);
 }
 
+static void
+test_ot_var_axis_on_zero_named_instance ()
+{
+  hb_face_t *face = hb_test_open_font_file ("fonts/Zycon.ttf");
+  g_assert (hb_ot_var_get_axis_count (face));
+  hb_face_destroy (face);
+}
+
 int
 main (int argc, char **argv)
 {
   hb_test_init (&argc, &argv);
 
   hb_test_add (test_ot_face_empty);
+  hb_test_add (test_ot_var_axis_on_zero_named_instance);
 
   return hb_test_run();
 }