From daca39681e56d05f5a158d1af1475bd3de3095e9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= Date: Fri, 10 Apr 2026 11:04:03 +0100 Subject: [PATCH] revive sftfuzzer for a different code path Change-Id: Idd2d422c54707262bb76069640e7e251489debfe Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/743 Tested-by: Jenkins CPCI Reviewed-by: Michael Stahl (cherry picked from commit acfe01e58b870f9414fc5b09c2c7abcc8bc5f764) Cherry-pick note: the fuzzer has been adapted to test 4c3c87e79d12388cda1a8ebd13b9724da89afac2 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/204900 Reviewed-by: Xisco Fauli Tested-by: Jenkins --- bin/oss-fuzz-setup.sh | 14 +++++----- vcl/Executable_fftester.mk | 4 +++ vcl/Executable_sftfuzzer.mk | 45 ++++++++++++++++++++++++++++++++ vcl/Module_vcl.mk | 1 + vcl/inc/font/TrueTypeFont.hxx | 2 ++ vcl/source/font/TrueTypeFont.cxx | 15 +++++++++++ vcl/source/fontsubset/cff.cxx | 9 +++++++ vcl/workben/fftester.cxx | 8 ++++++ vcl/workben/sftfuzzer.cxx | 43 ++++++++++++++++++++++++++++++ 9 files changed, 135 insertions(+), 6 deletions(-) create mode 100644 vcl/Executable_sftfuzzer.mk create mode 100644 vcl/workben/sftfuzzer.cxx diff --git a/bin/oss-fuzz-setup.sh b/bin/oss-fuzz-setup.sh index 4984a8821caf..abdcfde0e63a 100755 --- a/bin/oss-fuzz-setup.sh +++ b/bin/oss-fuzz-setup.sh @@ -116,15 +116,17 @@ mkdir -p afl-testcases && cd afl-testcases/ && tar xf $SRC/afl_testcases.tgz && zip -q $SRC/webpfuzzer_seed_corpus.zip afl-testcases/webp*/full/images/* # TTF/OTF/SFT -# using github's svn view to use svn export as a hack to just export part of the git repo -# svn support turned off now: https://github.blog/2023-01-20-sunsetting-subversion-support/ -# and git sparse checkout is a total pain -#svn export --force -q https://github.com/khaledhosny/ots/trunk/tests/fonts $SRC/sample-sft-fonts/ots -#svn export --force -q https://github.com/unicode-org/text-rendering-tests/trunk/fonts/ $SRC/sample-sft-fonts/unicode-org -#svn export --force -q https://github.com/harfbuzz/harfbuzz/trunk/test/shape/data/in-house/fonts $SRC/sample-sft-fonts/harfbuzz mkdir -p $SRC/sample-sft-fonts/adobe curl --no-progress-meter -S \ -C - -o $SRC/sample-sft-fonts/adobe/AdobeVFPrototype.otf https://github.com/adobe-fonts/adobe-variable-font-prototype/releases/download/1.005a/AdobeVFPrototype.otf +git clone --depth 1 --filter=blob:none --sparse https://github.com/khaledhosny/ots.git && \ + cd ots && git sparse-checkout set tests/fonts && cd .. && \ + cp -r ots/tests/fonts $SRC/sample-sft-fonts/ots && rm -rf ots +git clone --depth 1 --filter=blob:none --sparse https://github.com/harfbuzz/harfbuzz.git && \ + cd harfbuzz && git sparse-checkout set test/shape/data/in-house/fonts && cd .. && \ + cp -r harfbuzz/test/shape/data/in-house/fonts $SRC/sample-sft-fonts/harfbuzz && rm -rf harfbuzz +# exclude very large fonts that are slow to process under sanitizers +find $SRC/sample-sft-fonts -size +1M -delete zip -qr $SRC/sftfuzzer_seed_corpus.zip $SRC/sample-sft-fonts # PDF diff --git a/vcl/Executable_fftester.mk b/vcl/Executable_fftester.mk index 0c3ff92be3a7..ee82b1d72759 100644 --- a/vcl/Executable_fftester.mk +++ b/vcl/Executable_fftester.mk @@ -20,6 +20,10 @@ $(eval $(call gb_Executable_set_include,fftester,\ -I$(SRCDIR)/vcl/inc \ )) +$(eval $(call gb_Executable_use_externals,fftester,\ + harfbuzz \ +)) + $(eval $(call gb_Executable_use_libraries,fftester,\ tl \ sal \ diff --git a/vcl/Executable_sftfuzzer.mk b/vcl/Executable_sftfuzzer.mk new file mode 100644 index 000000000000..c608b13d5abb --- /dev/null +++ b/vcl/Executable_sftfuzzer.mk @@ -0,0 +1,45 @@ +# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*- +# +# +# This file is part of the Collabora Office project. +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. +# + +include $(SRCDIR)/vcl/commonfuzzer.mk + +$(eval $(call gb_Executable_Executable,sftfuzzer)) + +$(eval $(call gb_Executable_use_api,sftfuzzer,\ + offapi \ + udkapi \ +)) + +$(eval $(call gb_Executable_use_externals,sftfuzzer,\ + $(fuzzer_externals) \ +)) + +$(eval $(call gb_Executable_set_include,sftfuzzer,\ + $$(INCLUDE) \ + -I$(SRCDIR)/vcl/inc \ +)) + +$(eval $(call gb_Executable_use_libraries,sftfuzzer,\ + $(fuzzer_core_libraries) \ +)) + +$(eval $(call gb_Executable_use_static_libraries,sftfuzzer,\ + $(fuzzer_statics) \ +)) + +$(eval $(call gb_Executable_add_exception_objects,sftfuzzer,\ + vcl/workben/sftfuzzer \ +)) + +$(eval $(call gb_Executable_add_libs,sftfuzzer,\ + $(LIB_FUZZING_ENGINE) \ +)) + +# vim: set noet sw=4 ts=4: diff --git a/vcl/Module_vcl.mk b/vcl/Module_vcl.mk index b0dd76b00aa1..438678eb5597 100644 --- a/vcl/Module_vcl.mk +++ b/vcl/Module_vcl.mk @@ -215,6 +215,7 @@ $(eval $(call gb_Module_add_targets,vcl,\ Executable_mtpfuzzer \ Executable_htmlfuzzer \ Executable_eotfuzzer \ + Executable_sftfuzzer \ Executable_dbffuzzer \ Executable_webpfuzzer \ Executable_zipfuzzer \ diff --git a/vcl/inc/font/TrueTypeFont.hxx b/vcl/inc/font/TrueTypeFont.hxx index cbcaf68e4e41..308e7b2adb69 100644 --- a/vcl/inc/font/TrueTypeFont.hxx +++ b/vcl/inc/font/TrueTypeFont.hxx @@ -185,4 +185,6 @@ public: } // namespace vcl +int VCL_DLLPUBLIC TestFontParsing(const void* data, sal_uInt32 size); + /* vim:set shiftwidth=4 softtabstop=4 expandtab: */ diff --git a/vcl/source/font/TrueTypeFont.cxx b/vcl/source/font/TrueTypeFont.cxx index 0be8037cac2d..3d5ef1b1fd86 100644 --- a/vcl/source/font/TrueTypeFont.cxx +++ b/vcl/source/font/TrueTypeFont.cxx @@ -207,4 +207,19 @@ FontWeight TrueTypeFont::getFontWeight() const } // namespace vcl +int TestFontParsing(const void* data, sal_uInt32 size) +{ + // Exercise TrueType/OpenType parsing + if (data && size > 0) + { + FontSubsetInfo aInfo; + aInfo.m_nFontType = FontType::TYPE1_PFB; + + std::vector aOutBuffer; + vcl::ConvertCFFfontToType1(static_cast(data), size, aOutBuffer, + aInfo); + } + return 0; +} + /* vim:set shiftwidth=4 softtabstop=4 expandtab: */ diff --git a/vcl/source/fontsubset/cff.cxx b/vcl/source/fontsubset/cff.cxx index 5cac1e796d47..a2be0bae24fa 100644 --- a/vcl/source/fontsubset/cff.cxx +++ b/vcl/source/fontsubset/cff.cxx @@ -1700,6 +1700,15 @@ void CffContext::readDictOp() ValType nVal = fReal; push(nVal); } + else + { + // bytes 22-27, 31 and 255 are reserved in CFF DICT encoding + // (Adobe Technical Note #5176, section 4 "DICT Data") + // https://adobe-type-tools.github.io/font-tech-notes/pdfs/5176.CFF.pdf + // skip to avoid infinite loop + SAL_WARN("vcl.fonts.cff", "undefined CFF DICT byte: " << int(c)); + ++mpReadPtr; + } } void CffContext::read2push() diff --git a/vcl/workben/fftester.cxx b/vcl/workben/fftester.cxx index 406bbea264a9..1dddc63e153c 100644 --- a/vcl/workben/fftester.cxx +++ b/vcl/workben/fftester.cxx @@ -61,6 +61,7 @@ #include #include #include +#include #include #include #include @@ -262,6 +263,13 @@ SAL_IMPLEMENT_MAIN_WITH_ARGS(argc, argv) aFileStream.ReadBytes(aData.data(), aData.size()); ret = TestEOT(aData.data(), aData.size()); } + else if (strcmp(argv[2], "sft") == 0) + { + SvFileStream aFileStream(out, StreamMode::READ); + std::vector aData(aFileStream.remainingSize()); + aFileStream.ReadBytes(aData.data(), aData.size()); + ret = TestFontParsing(aData.data(), aData.size()); + } #ifndef DISABLE_DYNLOADING else if ((strcmp(argv[2], "doc") == 0) || (strcmp(argv[2], "ww8") == 0)) { diff --git a/vcl/workben/sftfuzzer.cxx b/vcl/workben/sftfuzzer.cxx new file mode 100644 index 000000000000..f27d201db8e8 --- /dev/null +++ b/vcl/workben/sftfuzzer.cxx @@ -0,0 +1,43 @@ +/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file is part of the Collabora Office project. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + */ + +#include +#include "commonfuzzer.hxx" + +#include +#include + +const lib_to_factory_mapping* lo_get_factory_map(void) +{ + static lib_to_factory_mapping map[] = { { 0, 0 } }; + + return map; +} + +const lib_to_constructor_mapping* lo_get_constructor_map(void) +{ + static lib_to_constructor_mapping map[] = { { 0, 0 } }; + + return map; +} + +extern "C" void* lo_get_custom_widget_func(const char*) { return nullptr; } + +extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) +{ + TypicalFuzzerInitialize(argc, argv); + return 0; +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + return TestFontParsing(data, size); +} + +/* vim:set shiftwidth=4 softtabstop=4 expandtab: */