This was found while fuzzing graphite2 1.3.5 (and is in 1.3.4)
What is the test string for this: "Whereas" seems to render correctly.
fixed upstream in a8b3ac2aed0eb132cd80efe7de88f8153e73c829
This issue is reproducible in latest revision (e569e28d83491fedb31b9220493f3c07f6ec6d80)
fixed upstream in a8f9210571f5339d55c7fd4524acb64ce5ca8fd8
This issue is reproducible in the latest revision (df41ce06dda5962b9ff1c8c3175af00005d5fc0f)
Sorry. Didn't notice the new test_case.ttf that was introduced before my last claim to have fixed it. Is this new test_case effectively a new bug? Anyway fixed? in latest upstream and I think in 234c9634b76d31a597e048aa8596996dbdc85165
Summary: graphite2: heap-buffer-overflow read in [@graphite2::Slot::getAttr] → graphite2: heap-buffer-overflow read in [@graphite2::Slot::getAttr] Slot.cpp:232
Verified existing test cases with aed0effc27edfb9da441dce3c77f5a1a3fd9f7db. I found a crash with a matching stack trace and logged it a bug 1249338.
You need to log in before you can comment on or make changes to this bug.