Repository: harfbuzz/harfbuzz
Fuzzing engine: libfuzzer
Fuzz target: hb-shape-fuzzer
Sanitizer: address
Crash type: UNKNOWN READ

Sanitizer report:
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 23431213
INFO: Loaded 1 modules   (25863 inline 8-bit counters): 25863 [0x55c62d791b70, 0x55c62d798077), 
INFO: Loaded 1 PC tables (25863 PCs): 25863 [0x55c62d798078,0x55c62d7fd0e8), 
/out/hb-shape-fuzzer: Running 1 inputs 1 time(s) each.
Running: /testcase/OSV-2018-119.poc
AddressSanitizer:DEADLYSIGNAL
=================================================================
==7==ERROR: AddressSanitizer: SEGV on unknown address 0x7f6e93670070 (pc 0x55c62d591116 bp 0x7fff8ff14490 sp 0x7fff8ff143d0 T0)
==7==The signal is caused by a READ memory access.
SCARINESS: 20 (wild-addr-read)
    #0 0x55c62d591116 in AAT::KerxSubTableFormat1<AAT::KerxSubTableHeader>::driver_context_t::transition(AAT::StateTableDriver<AAT::ExtendedTypes, AAT::Format1Entry<true>::EntryData>*, AAT::Entry<AAT::Format1Entry<true>::EntryData> const*) /src/harfbuzz/src/./hb-aat-layout-kerx-table.hh:284:23
    #1 0x55c62d5900e2 in void AAT::StateTableDriver<AAT::ExtendedTypes, AAT::Format1Entry<true>::EntryData>::drive<AAT::KerxSubTableFormat1<AAT::KerxSubTableHeader>::driver_context_t>(AAT::KerxSubTableFormat1<AAT::KerxSubTableHeader>::driver_context_t*) /src/harfbuzz/src/./hb-aat-layout-common.hh:759:11
    #2 0x55c62d58bc09 in apply /src/harfbuzz/src/./hb-aat-layout-kerx-table.hh:372:12
    #3 0x55c62d58bc09 in dispatch<AAT::KerxSubTableFormat1<AAT::KerxSubTableHeader> > /src/harfbuzz/src/./hb-aat-layout-common.hh:796:56
    #4 0x55c62d58bc09 in AAT::hb_aat_apply_context_t::return_t AAT::KerxSubTable::dispatch<AAT::hb_aat_apply_context_t>(AAT::hb_aat_apply_context_t*) const /src/harfbuzz/src/./hb-aat-layout-kerx-table.hh:803:13
    #5 0x55c62d55ab36 in AAT::KerxTable<AAT::kerx>::apply(AAT::hb_aat_apply_context_t*) const /src/harfbuzz/src/./hb-aat-layout-kerx-table.hh:925:18
    #6 0x55c62d55a41c in hb_aat_layout_position(hb_ot_shape_plan_t*, hb_font_t*, hb_buffer_t*) /src/harfbuzz/src/hb-aat-layout.cc:272:8
    #7 0x55c62d679a57 in hb_ot_position_complex /src/harfbuzz/src/hb-ot-shape.cc:837:5
    #8 0x55c62d679a57 in hb_ot_position /src/harfbuzz/src/hb-ot-shape.cc:884:3
    #9 0x55c62d679a57 in hb_ot_shape_internal /src/harfbuzz/src/hb-ot-shape.cc:955:3
    #10 0x55c62d679a57 in _hb_ot_shape /src/harfbuzz/src/hb-ot-shape.cc:978:3
    #11 0x55c62d552be3 in hb_shape_plan_execute /src/harfbuzz/src/./hb-shaper-list.hh:42:1
    #12 0x55c62d5517ca in hb_shape_full /src/harfbuzz/src/hb-shape.cc:143:19
    #13 0x55c62d5517ca in hb_shape /src/harfbuzz/src/hb-shape.cc:171:3
    #14 0x55c62d46c056 in LLVMFuzzerTestOneInput /src/harfbuzz/./test/fuzzing/hb-shape-fuzzer.cc:24:5
    #15 0x55c62d489020 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #16 0x55c62d474295 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #17 0x55c62d479d2f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #18 0x55c62d4a4fd2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #19 0x7f6a93de0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0702430aef5fa3dda43986563e9ffcc47efbd75e)
    #20 0x55c62d39379d in _start (/out/hb-shape-fuzzer+0xdf79d)

DEDUP_TOKEN: AAT::KerxSubTableFormat1<AAT::KerxSubTableHeader>::driver_context_t::transition(AAT::StateTableDriver<AAT::ExtendedTypes, AAT::Format1Entry<true>::EntryData>*, AAT::Entry<AAT::Format1Entry<true>::EntryData> const*)--void AAT::StateTableDriver<AAT::ExtendedTypes, AAT::Format1Entry<true>::EntryData>::drive<AAT::KerxSubTableFormat1<AAT::KerxSubTableHeader>::driver_context_t>(AAT::KerxSubTableFormat1<AAT::KerxSubTableHeader>::driver_context_t*)--apply
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /src/harfbuzz/src/./hb-aat-layout-kerx-table.hh:284:23 in AAT::KerxSubTableFormat1<AAT::KerxSubTableHeader>::driver_context_t::transition(AAT::StateTableDriver<AAT::ExtendedTypes, AAT::Format1Entry<true>::EntryData>*, AAT::Entry<AAT::Format1Entry<true>::EntryData> const*)
==7==ABORTING


Fix patch:
diff --git a/src/hb-aat-layout-kerx-table.hh b/src/hb-aat-layout-kerx-table.hh
index 6b61186a9..4e6c6e405 100644
--- a/src/hb-aat-layout-kerx-table.hh
+++ b/src/hb-aat-layout-kerx-table.hh
@@ -260,7 +260,7 @@ struct KerxSubTableFormat1
 	  depth = 0; /* Probably not what CoreText does, but better? */
       }
 
-      if (Format1EntryT::performAction (entry))
+      if (depth && Format1EntryT::performAction (entry))
       {
 	unsigned int tuple_count = MAX (1u, table->header.tuple_count ());
 
diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-5691469793329152 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-5691469793329152
new file mode 100644
index 000000000..6c7390002
Binary files /dev/null and b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-5691469793329152 differ