diff options
| author | Behdad Esfahbod <behdad@behdad.org> | 2023-02-06 14:51:25 -0700 |
|---|---|---|
| committer | Bowon Ryu <bowon.ryu@samsung.com> | 2023-06-20 14:44:34 +0900 |
| commit | 14f9852c0d6ae99c2881a28b4e5944a22c8587a7 (patch) | |
| tree | 3b8095c4da323f7fcecf74485cd22d2800dbf2e6 | |
| parent | 6bb543f4546849799bf794083c45eaecaf4cce7d (diff) | |
| download | harfbuzz-accepted/tizen_8.0_unified.tar.gz harfbuzz-accepted/tizen_8.0_unified.tar.bz2 harfbuzz-accepted/tizen_8.0_unified.zip | |
[Tizen] [GPOS] Avoid O(n^2) behavior in mark-attachmenttizen_8.0_m2_releaseaccepted/tizen/unified/riscv/20231211.234151accepted/tizen/unified/20230622.015422accepted/tizen/8.0/unified/20231005.094942tizen_8.0accepted/tizen_unified_riscvaccepted/tizen_8.0_unified
Better implementation; avoids arbitrary limit on look-back.
[CVE-2023-25193]
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0
allows attackers to trigger O(n^2) growth via consecutive marks
during the process of looking back for base glyphs when attaching marks.
https://nvd.nist.gov/vuln/detail/CVE-2023-25193
Change-Id: I778490c8c94aae046e38cb07f04753cbc26b8e6a
| -rw-r--r-- | src/hb-ot-layout-gsubgpos.hh | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/hb-ot-layout-gsubgpos.hh b/src/hb-ot-layout-gsubgpos.hh index 65de131..d9a068c 100644 --- a/src/hb-ot-layout-gsubgpos.hh +++ b/src/hb-ot-layout-gsubgpos.hh @@ -641,6 +641,9 @@ struct hb_ot_apply_context_t : uint32_t random_state; + signed last_base = -1; // GPOS uses + unsigned last_base_until = 0; // GPOS uses + hb_ot_apply_context_t (unsigned int table_index_, hb_font_t *font_, hb_buffer_t *buffer_) : @@ -673,7 +676,7 @@ struct hb_ot_apply_context_t : iter_context.init (this, true); } - void set_lookup_mask (hb_mask_t mask) { lookup_mask = mask; init_iters (); } + void set_lookup_mask (hb_mask_t mask) { lookup_mask = mask; last_base = -1; last_base_until = 0; init_iters (); } void set_auto_zwj (bool auto_zwj_) { auto_zwj = auto_zwj_; init_iters (); } void set_auto_zwnj (bool auto_zwnj_) { auto_zwnj = auto_zwnj_; init_iters (); } void set_random (bool random_) { random = random_; } |