Merge pull request #98 from rsheeter/master

Fix woff2_compress fuzzer bugs
google · Oct 13, 2017 · 5bbcf1f · 5bbcf1f
2 parents 550cfa6 + 677800f
commit 5bbcf1f
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/src/font.cc b/src/font.cc
@@ -123,6 +123,9 @@ bool ReadCollectionFont(Buffer* file, const uint8_t* data, size_t len,
       (*all_tables)[table.offset] = font->FindTable(table.tag);
     } else {
       table.reuse_of = (*all_tables)[table.offset];
+      if (table.tag != table.reuse_of->tag) {
+        return FONT_COMPRESSION_FAILURE();
+      }
     }
 
   }

diff --git a/src/normalize.cc b/src/normalize.cc
@@ -96,7 +96,10 @@ bool MakeEditableBuffer(Font* font, int tableTag) {
   int sz = Round4(table->length);
   table->buffer.resize(sz);
   uint8_t* buf = &table->buffer[0];
-  memcpy(buf, table->data, sz);
+  memcpy(buf, table->data, table->length);
+  if (PREDICT_FALSE(sz > table->length)) {
+    memset(buf + table->length, 0, sz - table->length);
+  }
   table->data = buf;
   return true;
 }