harfbuzz 1.4.4

git-svn-id: svn://tug.org/texlive/trunk@43412 c570f23f-e606-0410-a88d-b1316a301751

6 files changed, 112 insertions, 8 deletions

diff --git a/Build/source/libs/harfbuzz/harfbuzz-src/ChangeLog b/Build/source/libs/harfbuzz/harfbuzz-src/ChangeLog
index 12e9995315f..f0964ec544b 100644
--- a/Build/source/libs/harfbuzz/harfbuzz-src/ChangeLog
+++ b/Build/source/libs/harfbuzz/harfbuzz-src/ChangeLog
@@ -1,3 +1,79 @@
+commit 9ac9af725c781f4597e8db46cf330d595c072739
+Author: Behdad Esfahbod <behdad@behdad.org>
+Date:   Sun Mar 5 13:51:01 2017 -0800
+
+    Add TODO item
+
+ src/hb-ot-layout-gsubgpos-private.hh | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+commit 5aec2fb8d0a4db52ae414d980b66018ca5ce1e9c
+Author: Behdad Esfahbod <behdad@behdad.org>
+Date:   Thu Mar 2 11:46:33 2017 -0800
+
+    Remove TODO item that is not going to happen
+
+ src/hb-ot-shape.cc | 1 -
+ 1 file changed, 1 deletion(-)
+
+commit b9b005f3a44ccf78a45b212b126287b69b9f4b40
+Author: Behdad Esfahbod <behdad@behdad.org>
+Date:   Wed Mar 1 14:27:23 2017 -0800
+
+    Fix Context lookup application when moving back after a glyph delete
+
+    This was broken forever, since days that we did not allow moving
+    tape backwards. Works now. Reported by Doug Felt.
+
+ src/hb-ot-layout-gsubgpos-private.hh                     |   7 +++----
+ .../sha1sum/5bbf3712e6f79775c66a4407837a90e591efbef2.ttf | Bin 0 ->
+ 6400 bytes
+ test/shaping/tests/context-matching.tests                |   1 +
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+commit a11501444cfc4854bfe2b1d3ce0fc5a957e959d8
+Author: Behdad Esfahbod <behdad@behdad.org>
+Date:   Sat Feb 25 13:37:54 2017 -0800
+
+    Add few tests found by libFuzzer and oss-fuzz
+
+ .../sha1sum/a34a9191d9376bda419836effeef7e75c1386016.ttf | Bin 0 ->
+ 1010 bytes
+ .../sha1sum/a69118c2c2ada48ff803d9149daa54c9ebdae30e.ttf | Bin 0 ->
+ 820 bytes
+ .../sha1sum/b6acef662e0beb8d5fcf5b61c6b0ca69537b7402.ttf | Bin 0 ->
+ 3301 bytes
+ .../sha1sum/e88c339237f52d21e01c55f01b9c1b4cc14a0467.ttf | Bin 0 ->
+ 515 bytes
+ test/shaping/tests/fuzzed.tests                          |   4 ++++
+ 5 files changed, 4 insertions(+)
+
+commit 85630996b8afa699f7b5d19346cdf5c72fcd6e2d
+Author: Behdad Esfahbod <behdad@behdad.org>
+Date:   Sat Feb 25 13:30:38 2017 -0800
+
+    Fix buffer-overrun with Bengali reph positioning code
+
+    This has no security implications whatsoever since we always keep
+    and extra element at the end of buffer, just in case.
+
+    Discovered by oss-fuzz
+    CC https://github.com/behdad/harfbuzz/issues/139
+    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=660
+
+ src/hb-ot-shape-complex-indic.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 6685d281d6f50bf046bbfef4a5263e15d15f2f02
+Author: Behdad Esfahbod <behdad@behdad.org>
+Date:   Sat Feb 25 11:35:05 2017 -0800
+
+    1.4.3
+
+ NEWS         | 12 ++++++++++++
+ configure.ac |  2 +-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
 commit a657f23ca31237d652b5c101ed24194b6aeadaf8
 Author: Dominik Röttsches <d-r@roettsches.de>
 Date:   Mon Feb 20 21:52:07 2017 +0200
diff --git a/Build/source/libs/harfbuzz/harfbuzz-src/NEWS b/Build/source/libs/harfbuzz/harfbuzz-src/NEWS
index e175b38a8f5..48a51d68fe4 100644
--- a/Build/source/libs/harfbuzz/harfbuzz-src/NEWS
+++ b/Build/source/libs/harfbuzz/harfbuzz-src/NEWS
@@ -1,3 +1,11 @@
+Overview of changes leading to 1.4.4
+Sunday, March 5, 2017
+====================================
+
+- Fix Context lookup application when moving back after a glyph deletion.
+- Fix buffer-overrun in Bengali.
+
+
 Overview of changes leading to 1.4.3
 Saturday, February 25, 2017
 ====================================
diff --git a/Build/source/libs/harfbuzz/harfbuzz-src/configure.ac b/Build/source/libs/harfbuzz/harfbuzz-src/configure.ac
index a3eb0f02136..55b48a53b8a 100644
--- a/Build/source/libs/harfbuzz/harfbuzz-src/configure.ac
+++ b/Build/source/libs/harfbuzz/harfbuzz-src/configure.ac
@@ -1,6 +1,6 @@
 AC_PREREQ([2.64])
 AC_INIT([HarfBuzz],
-        [1.4.3],
+        [1.4.4],
         [https://github.com/behdad/harfbuzz/issues/new],
         [harfbuzz],
         [http://harfbuzz.org/])
diff --git a/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-gsubgpos-private.hh b/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-gsubgpos-private.hh
index 0c423526861..005ed21d804 100644
--- a/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-gsubgpos-private.hh
+++ b/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-gsubgpos-private.hh
@@ -996,17 +996,38 @@ static inline bool apply_lookup (hb_apply_context_t *c,
     if (!delta)
         continue;
 
-    /* Recursed lookup changed buffer len.  Adjust. */
+    /* Recursed lookup changed buffer len.  Adjust.
+     *
+     * TODO:
+     *
+     * Right now, if buffer length increased by n, we assume n new glyphs
+     * were added right after the current position, and if buffer length
+     * was decreased by n, we assume n match positions after the current
+     * one where removed.  The former (buffer length increased) case is
+     * fine, but the decrease case can be improved in at least two ways,
+     * both of which are significant:
+     *
+     *   - If recursed-to lookup is MultipleSubst and buffer length
+     *     decreased, then it's current match position that was deleted,
+     *     NOT the one after it.
+     *
+     *   - If buffer length was decreased by n, it does not necessarily
+     *     mean that n match positions where removed, as there might
+     *     have been marks and default-ignorables in the sequence.  We
+     *     should instead drop match positions between current-position
+     *     and current-position + n instead.
+     *
+     * It should be possible to construct tests for both of these cases.
+     */
 
     end += delta;
-    if (end <= int (match_positions[idx]))
+    if (end < int (match_positions[idx]))
     {
       /* End might end up being smaller than match_positions[idx] if the recursed
-       * lookup ended up removing many items, more than we have had matched.
+       * lookup ended up removing too many items.
        * Just never rewind end back and get out of here.
        * https://bugs.chromium.org/p/chromium/issues/detail?id=659496 */
       end = match_positions[idx];
-      /* There can't be any further changes. */
       break;
     }
 
@@ -1019,7 +1040,7 @@ static inline bool apply_lookup (hb_apply_context_t *c,
     }
     else
     {
-      /* NOTE: delta is negative. */
+      /* NOTE: delta is non-positive. */
       delta = MAX (delta, (int) next - (int) count);
       next -= delta;
     }
diff --git a/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-shape-complex-indic.cc b/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-shape-complex-indic.cc
index b48fb561c39..ec12ce69e0b 100644
--- a/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-shape-complex-indic.cc
+++ b/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-shape-complex-indic.cc
@@ -1497,7 +1497,7 @@ final_reordering_syllable (const hb_ot_shape_plan_t *plan,
     if (reph_pos == REPH_POS_AFTER_SUB)
     {
       new_reph_pos = base;
-      while (new_reph_pos < end &&
+      while (new_reph_pos + 1 < end &&
 	     !( FLAG_SAFE (info[new_reph_pos + 1].indic_position()) & (FLAG (POS_POST_C) | FLAG (POS_AFTER_POST) | FLAG (POS_SMVD))))
 	new_reph_pos++;
       if (new_reph_pos < end)
diff --git a/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-shape.cc b/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-shape.cc
index 2eacb34c4d9..29f5e58e519 100644
--- a/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-shape.cc
+++ b/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-shape.cc
@@ -378,7 +378,6 @@ hb_ot_shape_setup_masks_fraction (hb_ot_shape_context_t *c)
     post_mask = c->plan->numr_mask | c->plan->frac_mask;
   }
 
-  /* TODO look in pre/post context text also. */
   unsigned int count = buffer->len;
   hb_glyph_info_t *info = buffer->info;
   for (unsigned int i = 0; i < count; i++)