Range-check custom typeface glyph ids

Bug: b/375261949 Change-Id: I52f17360ab88d8a9dd99aa4d85be64f34b991064 Reviewed-on: https://skia-review.googlesource.com/c/skia/+/913336 Reviewed-by: Ben Wagner <[email protected]> Reviewed-by: Florin Malita <[email protected]> Commit-Queue: Florin Malita <[email protected]>
HistoryFork · Oct 28, 2024 · eb8759b · eb8759b
1 parent 98a0689
commit eb8759b
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 2 deletions.
diff --git a/src/utils/SkCustomTypeface.cpp b/src/utils/SkCustomTypeface.cpp
@@ -259,9 +259,15 @@ class SkUserScalerContext : public SkScalerContext {
         GlyphMetrics mx(glyph.maskFormat());
 
         const SkUserTypeface* tf = this->userTF();
-        mx.advance = fMatrix.mapXY(tf->fGlyphRecs[glyph.getGlyphID()].fAdvance, 0);
+        const SkGlyphID gid = glyph.getGlyphID();
+        if (gid >= tf->fGlyphRecs.size()) {
+            mx.neverRequestPath = true;
+            return mx;
+        }
+
+        const auto& rec = tf->fGlyphRecs[gid];
+        mx.advance = fMatrix.mapXY(rec.fAdvance, 0);
 
-        const auto& rec = tf->fGlyphRecs[glyph.getGlyphID()];
         if (rec.isDrawable()) {
             mx.maskFormat = SkMask::kARGB32_Format;
 

diff --git a/tests/TypefaceTest.cpp b/tests/TypefaceTest.cpp
@@ -8,6 +8,7 @@
 #include "include/core/SkData.h"
 #include "include/core/SkFont.h"
 #include "include/core/SkFontArguments.h"
+#include "include/core/SkFontMetrics.h"
 #include "include/core/SkFontMgr.h"
 #include "include/core/SkFontParameters.h"
 #include "include/core/SkFontStyle.h"
@@ -20,6 +21,7 @@
 #include "include/core/SkTypes.h"
 #include "include/private/base/SkFixed.h"
 #include "include/private/base/SkTemplates.h"
+#include "include/utils/SkCustomTypeface.h"
 #include "src/base/SkEndian.h"
 #include "src/base/SkUTF.h"
 #include "src/core/SkFontDescriptor.h"
@@ -710,3 +712,20 @@ DEF_TEST(LegacyMakeTypeface, reporter) {
         REPORTER_ASSERT(reporter, typeface3->isBold());
     }
 }
+
+DEF_TEST(CustomTypeface_invalid_glyphid, reporter) {
+    SkPath glyph_path;
+    glyph_path.addRect({10, 20, 30, 40});
+
+    SkCustomTypefaceBuilder builder;
+    builder.setGlyph(0, 42, glyph_path);
+
+    SkFont custom_font(builder.detach(), 1);
+
+    SkGlyphID glyph_ids[] = {0, 1};
+    SkRect bounds[2];
+    custom_font.getBounds(glyph_ids, 2, bounds, nullptr);
+
+    REPORTER_ASSERT(reporter, bounds[0] == SkRect::MakeLTRB(10, 20, 30, 40));
+    REPORTER_ASSERT(reporter, bounds[1] == SkRect::MakeLTRB(0, 0, 0, 0));
+}