Merge cherrypicks of [4741663, 4741664, 4741665, 4741666, 4743080, 4743081, 4743082, 4743083, 4741262, 4741263, 4741264, 4741265, 4741266, 4741667, 4743084, 4741242, 4741243, 4741741, 4741742, 4741743, 4741744, 4741822, 4743085, 4741668, 4741338, 4743055, 4743056, 4743070, 4743073, 4743075, 4743076, 4743078, 4743079, 4743161, 4743162, 4743164, 4743165, 4743167, 4743168, 4743169, 4743170, 4741681, 4741682, 4741683, 4741684, 4741685, 4741686, 4741687, 4741688, 4741689, 4741690, 4741691, 4741692, 4741693, 4741694, 4741695, 4741696, 4741697, 4741698, 4741699, 4743240, 4743241, 4743242, 4743243, 4741745, 4741823, 4741824, 4741825, 4741267, 4741268, 4743244, 4743280, 4743281, 4743224, 4743203, 4743204, 4743205, 4741746, 4741747, 4743245, 4741826, 4741827, 4741828, 4741829, 4741748, 4741749, 4741750, 4743233, 4743282, 4741244, 4741245, 4741246, 4741247, 4743206, 4743207, 4743208, 4743209, 4743210, 4743211, 4743212, 4743213, 4743214, 4743215, 4743216, 4743217, 4743218, 4743219, 4743360, 4743361, 4743362, 4743363, 4743364, 4743365, 4743366, 4743367, 4743368, 4743369, 4743370, 4743371, 4743372, 4743373, 4743374, 4743375, 4743376, 4743377, 4743283, 4743284, 4741830, 4742501, 4743246, 4743086, 4743087, 4743378, 4743379, 4741751] into sparse-4749909-L04200000199131547android-8.1.0_r52android-8.1.0_r50android-8.1.0_r47android-8.1.0_r46oreo-m7-releaseoreo-m6-s4-release

Change-Id: I249d862ee435b6a9426f4a84d0e27e9afc6fc676

4 files changed, 129 insertions, 6 deletions

diff --git a/libs/minikin/FontUtils.cpp b/libs/minikin/FontUtils.cpp
index c5a32f8..60b3163 100644
--- a/libs/minikin/FontUtils.cpp
+++ b/libs/minikin/FontUtils.cpp
@@ -19,6 +19,8 @@
 
 #include "FontUtils.h"
 
+#include <log/log.h>
+
 namespace minikin {
 
 static uint16_t readU16(const uint8_t* data, size_t offset) {
@@ -44,7 +46,7 @@ bool analyzeStyle(const uint8_t* os2_data, size_t os2_size, int* weight, bool* i
     return true;
 }
 
-void analyzeAxes(const uint8_t* fvar_data, size_t fvar_size, std::unordered_set<uint32_t>* axes) {
+bool analyzeAxes(const uint8_t* fvar_data, size_t fvar_size, std::unordered_set<uint32_t>* axes) {
     const size_t kMajorVersionOffset = 0;
     const size_t kMinorVersionOffset = 2;
     const size_t kOffsetToAxesArrayOffset = 4;
@@ -54,7 +56,7 @@ void analyzeAxes(const uint8_t* fvar_data, size_t fvar_size, std::unordered_set<
     axes->clear();
 
     if (fvar_size < kAxisSizeOffset + 2) {
-        return;
+        return false;
     }
     const uint16_t majorVersion = readU16(fvar_data, kMajorVersionOffset);
     const uint16_t minorVersion = readU16(fvar_data, kMinorVersionOffset);
@@ -63,15 +65,19 @@ void analyzeAxes(const uint8_t* fvar_data, size_t fvar_size, std::unordered_set<
     const uint32_t axisSize = readU16(fvar_data, kAxisSizeOffset);
 
     if (majorVersion != 1 || minorVersion != 0 || axisOffset != 0x10 || axisSize != 0x14) {
-        return;  // Unsupported version.
+        return false;  // Unsupported version.
     }
-    if (fvar_size < axisOffset + axisOffset * axisCount) {
-        return;  // Invalid table size.
+    if (fvar_size < axisOffset + axisSize * axisCount) {
+        if (axisOffset > axisSize) {
+            android_errorWriteLog(0x534e4554, "77822336");
+        }
+        return false;  // Invalid table size.
     }
     for (uint32_t i = 0; i < axisCount; ++i) {
         size_t axisRecordOffset = axisOffset + i * axisSize;
         uint32_t tag = readU32(fvar_data, axisRecordOffset);
         axes->insert(tag);
     }
+    return true;
 }
 }  // namespace minikin
diff --git a/libs/minikin/FontUtils.h b/libs/minikin/FontUtils.h
index d26d5e4..ecb9cde 100644
--- a/libs/minikin/FontUtils.h
+++ b/libs/minikin/FontUtils.h
@@ -22,7 +22,7 @@
 namespace minikin {
 
 bool analyzeStyle(const uint8_t* os2_data, size_t os2_size, int* weight, bool* italic);
-void analyzeAxes(const uint8_t* fvar_data, size_t fvar_size, std::unordered_set<uint32_t>* axes);
+bool analyzeAxes(const uint8_t* fvar_data, size_t fvar_size, std::unordered_set<uint32_t>* axes);
 
 }  // namespace minikin
 
diff --git a/tests/unittest/Android.bp b/tests/unittest/Android.bp
index 348d186..770d7be 100644
--- a/tests/unittest/Android.bp
+++ b/tests/unittest/Android.bp
@@ -46,6 +46,7 @@ cc_test {
         "FontCollectionItemizeTest.cpp",
         "FontFamilyTest.cpp",
         "FontLanguageListCacheTest.cpp",
+        "FontUtilsTest.cpp",
         "HbFontCacheTest.cpp",
         "HyphenatorTest.cpp",
         "GraphemeBreakTests.cpp",
diff --git a/tests/unittest/FontUtilsTest.cpp b/tests/unittest/FontUtilsTest.cpp
new file mode 100644
index 0000000..15675c9
--- /dev/null
+++ b/tests/unittest/FontUtilsTest.cpp
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "FontUtils.h"
+
+#include <gtest/gtest.h>
+
+namespace minikin {
+namespace {
+
+constexpr uint32_t MakeTag(char c1, char c2, char c3, char c4) {
+    return ((uint32_t)c1 << 24) | ((uint32_t)c2 << 16) | ((uint32_t)c3 << 8) | (uint32_t)c4;
+}
+
+static size_t writeU16(uint16_t x, uint8_t* out, size_t offset) {
+    out[offset] = x >> 8;
+    out[offset + 1] = x;
+    return offset + 2;
+}
+
+static size_t writeU32(uint32_t x, uint8_t* out, size_t offset) {
+    out[offset] = x >> 24;
+    out[offset + 1] = x >> 16;
+    out[offset + 2] = x >> 8;
+    out[offset + 3] = x;
+    return offset + 4;
+}
+
+static uint32_t floatToFixed(float x) {
+    return (uint32_t)(x * 65536);
+}
+
+struct Fvar {
+    Fvar(uint32_t tag, float minValue, float defaultValue, float maxValue)
+            : tag(tag), minValue(minValue), defaultValue(defaultValue), maxValue(maxValue) {}
+
+    uint32_t tag;
+    float minValue;
+    float defaultValue;
+    float maxValue;
+};
+
+// Returns valid fvar table contents. No InstanceRecord are filled.
+static std::vector<uint8_t> buildFvarTable(const std::vector<Fvar>& fvars) {
+    const uint32_t HEADER_SIZE = 0x10;
+    const uint32_t AXIS_RECORD_SIZE = 0x14;
+    std::vector<uint8_t> out(HEADER_SIZE + fvars.size() * AXIS_RECORD_SIZE);
+    size_t head = writeU16(1, out.data(), 0);             // major version
+    head = writeU16(0, out.data(), head);                 // minor version
+    head = writeU16(HEADER_SIZE, out.data(), head);       // axes array offset
+    head = writeU16(2, out.data(), head);                 // reserved
+    head = writeU16(fvars.size(), out.data(), head);      // count of axes
+    head = writeU16(AXIS_RECORD_SIZE, out.data(), head);  // size of variaiton axis record
+    head = writeU16(0, out.data(), head);                 // number of instance record count
+    head = writeU16(0, out.data(), head);                 // instance record size
+
+    for (const Fvar& fvar : fvars) {
+        head = writeU32(fvar.tag, out.data(), head);
+        head = writeU32(floatToFixed(fvar.minValue), out.data(), head);
+        head = writeU32(floatToFixed(fvar.defaultValue), out.data(), head);
+        head = writeU32(floatToFixed(fvar.maxValue), out.data(), head);
+        head = writeU16(0, out.data(), head);  // flags
+        head = writeU16(0, out.data(), head);  // axis name ID
+    }
+
+    return out;
+}
+
+TEST(FontUtilsTest, analyzeAxes_tagCount) {
+    std::vector<uint8_t> fvarTable = buildFvarTable({
+            Fvar(MakeTag('w', 'd', 't', 'h'), 0.0f, 1.0f, 2.0f),
+            Fvar(MakeTag('w', 'g', 'h', 't'), 0.0f, 1.0f, 2.0f),
+    });
+
+    std::unordered_set<uint32_t> axes;
+    ASSERT_TRUE(analyzeAxes(fvarTable.data(), fvarTable.size(), &axes));
+    ASSERT_EQ(2u, axes.size());
+    EXPECT_EQ(1u, axes.count(MakeTag('w', 'd', 't', 'h')));
+    EXPECT_EQ(1u, axes.count(MakeTag('w', 'g', 'h', 't')));
+    EXPECT_EQ(0u, axes.count(MakeTag('s', 'l', 'n', 't')));
+}
+
+TEST(FontUtilsTest, analyzeAxes_emptyBuffer) {
+    std::vector<uint8_t> fvarTable;
+    std::unordered_set<uint32_t> axes;
+    ASSERT_FALSE(analyzeAxes(fvarTable.data(), fvarTable.size(), &axes));
+}
+
+TEST(FontUtilsTest, analyzeAxes_invalidTableSize) {
+    std::vector<uint8_t> fvarTable = buildFvarTable({
+            Fvar(MakeTag('w', 'd', 't', 'h'), 0.0f, 1.0f, 2.0f),
+            Fvar(MakeTag('w', 'g', 'h', 't'), 0.0f, 1.0f, 2.0f),
+    });
+
+    fvarTable.resize(1000);
+    writeU16(50, fvarTable.data(), 8);  // Set axisCount = 50
+
+    std::unordered_set<uint32_t> axes;
+    ASSERT_FALSE(analyzeAxes(fvarTable.data(), fvarTable.size(), &axes));
+}
+
+}  // namespace
+}  // namespace minikin