Chrome · Fonts
CVE-2026-95311
Logic Error in Fonts
Overview
Medium
Severity
9.6
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- `fontconfig`
- The third-party font-configuration library, vendored under
third_party/fontconfig, that Chrome uses on Linux to enumerate, match, and cache system fonts. - `FcCache`
- Fontconfig’s on-disk cache format that stores serialized font metadata (including
FcCharSetcharset data) in a memory-mapped file region for fast reuse across processes. - Free of non-heap memory
- Calling
free()(or an equivalent deallocation) on a pointer that was not obtained from the heap allocator, such as a pointer into a memory-mapped cache buffer, which corrupts allocator state or crashes. - `FcCharSet`
- The fontconfig object describing the set of Unicode code points a font covers, whose internal arrays are among the cache-resident structures that must be validated before use.
Root Cause Analysis
Chrome loads fontconfig cache files (FcCache) from local, memory-mapped storage and deserializes structures such as FcCharSet charset data directly out of the mapped region. In the vulnerable version (2.18.1), the charset/cache validation logic loading these local cache files failed to fully validate offsets and structure provenance, so a deserialized pointer that actually referenced non-heap (mmap-backed or otherwise non-allocator) memory could later be passed to a free path. This violated the invariant that only heap-allocated pointers are handed to free(), producing the “Free of non-heap memory” condition.
The fix is the roll of third_party/fontconfig/src from b707078e6 to d17ee184e, which pulls in the upstream commit “Fix arbitrary free in cache validation” (and the related charset validation hardening) so that cache-resident pointers are validated and not incorrectly freed. Because this is a vendored-dependency roll, the change lands as an updated src submodule pin plus regenerated generated headers rather than as edits to Chrome’s own C++ functions.
Key insight
The single core mistake is trusting a pointer/offset read out of a local fontconfig cache file as if it were a heap allocation and later freeing it; the fix hardens cache-load validation upstream so such non-heap pointers are rejected before any deallocation occurs.
Attack Path
- Deliver a crafted cache An attacker arranges for a malicious or corrupted fontconfig cache file to be present where Chrome’s fontconfig will load it, since the advisory frames the issue as occurring “when loading local cache files.” (inferred)
- Trigger cache load
Font enumeration or matching in Chrome causes fontconfig to memory-map and deserialize the cache, reading
FcCharSet/charset structures whose offsets are not fully validated in the vulnerable version. - Produce a non-heap pointer Insufficient charset/cache validation yields a pointer that references non-heap (mmap-backed) memory but is treated as an owned allocation.
- Free of non-heap memory
A subsequent cleanup or destroy path calls
free()on that pointer, causing the free-of-non-heap-memory fault and consequent allocator corruption or crash. - Escalation to memory corruption primitive Corrupting allocator metadata via the invalid free could be leveraged toward a more powerful memory-corruption primitive, though the patch itself (a dependency roll) does not demonstrate a specific sink. (inferred)
Impact Assessment
An attacker who controls a local fontconfig cache file can cause fontconfig to free non-heap memory, corrupting allocator state within whatever Chrome process performs font loading (typically the browser process on Linux) and at minimum crashing it. Escalation from this invalid free to controlled memory corruption or code execution is plausible but not established by the patch, which is a version roll rather than an exploit-specific fix. The vendor advisory rates this medium severity and does not report in-the-wild exploitation; NVD scores it CVSS 9.6. The impact as “Free of non-heap memory in Fonts”; it does not report exploited-in-the-wild status or a specific severity here.
Files Changed
third_party/fontconfig/include/fcalias.hthird_party/fontconfig/include/fontconfig/fontconfig.hthird_party/fontconfig/README.chromiumthird_party/fontconfig/update.shthird_party/fontconfig/include/fc-lang/fclang.hDEPSthird_party/fontconfig/include/fcaliastail.hthird_party/fontconfig/srcthird_party/fontconfig/include/fc-genericfamily/fcgenericfamily.hthird_party/fontconfig/include/meson-config.h
Audit Directions
- Deserialization of memory-mapped cachesAudit every path that reads pointers, offsets, or lengths out of
FcCache/mmap-backed files and later frees or writes through them, ensuring provenance is validated before deallocation. - Free of non-owned pointersSearch fontconfig and other vendored libraries for
free()/destroy calls on pointers that may originate from mapped or static memory rather than the heap allocator. - Vendored dependency freshnessTrack upstream
third_party/fontconfigsecurity commits and roll promptly, since Chrome inherits logic bugs like this arbitrary free directly from the pinnedsrcrevision.
Patch
From 1eb1ce1c13b0ff7034d2d3db1214b8174c9e8ac5 Mon Sep 17 00:00:00 2001
From: Dominik Röttsches <drott@chromium.org>
Date: Fri, 04 Sep 2026 06:03:31 -0700
Subject: [PATCH] [M154] Roll src/third_party/fontconfig/src/ b707078e6..d17ee184e (67 commits)
Original change's description:
> Roll src/third_party/fontconfig/src/ b707078e6..d17ee184e (67 commits)
>
> Addresses charset validation issue when loading local cache files.
> Updates genericfamily.h with new values from upstream.
>
> https://chromium.googlesource.com/external/fontconfig.git/+log/b707078e6e8b..d17ee184e436
>
> $ git log b707078e6..d17ee184e --date=short --no-merges --format='%ad %ae %s'
> 2026-09-03 akira Add 'since' attribute to skip config rules by fontconfig version
> 2026-09-02 drott Fix arbitrary free in cache validation
> 2026-09-02 akira Fix uninitialized read from GNU stderror_r variant
> 2026-08-27 akira Drop autotools build support
> 2026-08-25 akira ci: workaround the hangup and warning on MSYS2
> 2026-08-25 akira Fix data race on lazy-init statics in FcCacheIsNewVersion
> 2026-08-24 akira ci: Add the thread sanitizer job
> 2026-08-24 akira Add multithreaded cache stress test and pattern-access benchmark
> 2026-08-23 heftig Remove extra Segoe UI fonts from system-ui
> 2026-08-21 akira Add tests for application fonts query and reinitialization
> 2026-08-21 akira Preserve application fonts across reinitialization
> 2026-08-21 akira Add FcConfigGetAppFonts() to query application fonts
> 2026-08-21 akira Guard against mixing plain strings and triples in an FcStrSet
> 2026-08-21 akira Refactor FcConfigCreate/Destroy()
> 2026-08-16 jeremyhu Do not strip a current directory prefix off an absolute glob
> 2026-08-16 jeremyhu Do not dereference a NULL glob string
> 2026-08-10 akira ci: Add linter for changelog trailer
> 2026-08-08 bgilbert meson: override fontconfig dependency for parent project
> 2026-08-10 akira Fix "Build target preprocessor_0 has no sources" warning
> 2026-08-07 akira Fix Y2038 overflow in cache mtime by using pad2 as upper 32 bits
> 2026-08-06 akira Bump version to 2.18.3
> 2026-08-05 akira Update INSTALL
> 2026-07-31 akira Fix the compiler warnings on MinGW
> 2026-07-31 akira ci: Bump FreeBSD version to 14.4
> 2026-07-31 akira Fix another compiler warnings
> 2026-07-31 akira fc-fontations: Allow unnecessary_transmutes lint in bindgen-generated Rust code
> 2026-07-31 akira test: Fix compiler warnings
> 2026-07-31 akira ci: Update base ci-templates
> 2026-07-31 akira ci: reduce more duplicate jobs
> 2026-07-31 akira ci: gate distro jobs until all tests passed
> 2026-07-31 akira ci: cleanup
> 2026-07-31 akira ci: drop duplicate pipelines
> 2026-07-31 akira ci: Enable -Werror in CI
> 2026-07-31 akira test: Fix test_genconf.py to avoid unexpected family name in testing conf
> 2026-07-30 akira Allow to limit the targeted family for TTC
> 2026-07-30 akira fc-genconf: Use alias syntactic-sugar instead of the pair of test-edit config
> 2026-07-23 akira Add implicit rule to update genericfamily property against syntactic-sugar
> 2026-07-29 akira ci: Update dependencies
> 2026-07-29 akira fc-cache: Create backward-compatible cache symlinks for cross-version discovery
> 2026-07-28 akira Add orth files for ancient scripts (xna, hlu, ecy)
> 2026-07-27 akira test: Add cache format compatibility tests for orth file additions
> 2026-07-25 akira ci: Suppress abidiff false positives for all internal structs
> 2026-07-24 akira Add orth files for Cuneiform languages (akk, sux, hit)
> 2026-07-24 akira Update mni.orth to use Meetei Mayek script
> 2026-07-24 akira Add orth files for scripts used by Noto font families
> 2026-07-24 akira Update orth files for jv, so, su, tl to use native scripts
> 2026-07-24 akira Add an orth file for Balinese
> 2026-07-24 akira Correct sat.orth
> 2026-07-22 serval2412 Fix unknown type name locale_t on macOS
> 2026-07-19 serval2412 Fix "FileType is deprecated"
> 2026-07-16 akira Drop Noto Sans CJK KR from 60-nonlatin.conf
> 2026-07-16 akira Add Noto Sans as system-ui for fallback
> 2026-07-14 akira Fix a null pointer dereference
> 2026-07-14 akira Workaround a longstanding use-after-free warning
> 2026-07-14 akira fc-cat: exit with non-zero if not successfully done
> 2026-07-14 akira ci: Add --werror option to the build script
> 2026-07-09 akira Bump version to 2.18.2
> 2026-07-09 akira new-version.sh: fix an error
> 2026-07-07 emilio Fix FcNameUnparse regression.
> 2026-07-06 akira Use Special FC_CACHE_VERSION for snapshot
> 2026-07-02 akira fc-genericfamily: Add major missing fonts across multiple categories
> 2026-07-02 akira Do not ship unnecessary files in archive
> 2026-07-01 akira Add more conditional code for FcLocaleSetCurrent()
> 2026-07-02 akira conf.d/Makefile.am: install 05-macos.conf for macOS only
> 2026-06-30 akira fc-cache: do not generate cache when target directory is in deny list
> 2026-06-30 akira fc-genericfamily: Add Noto fonts
> 2026-06-30 akira doc: Fallback to wkhtmltopdf if no docbook2pdf available
>
> Created with update.sh in third_party/fontconfig.
>
> Fixed: 553123003
> Change-Id: Ib4fa0fad9a79369a7abfa0908d1fcc23d8b8e2ba
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8352703
> Reviewed-by: Thomas Anderson <thomasanderson@chromium.org>
> Commit-Queue: Koji Ishii <kojii@chromium.org>
> Commit-Queue: Dominik Röttsches <drott@chromium.org>
> Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
> Reviewed-by: Koji Ishii <kojii@chromium.org>
> Auto-Submit: Dominik Röttsches <drott@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#1691760}
(cherry picked from commit 09fc04e0511c6ac4abe581d6794f9e7891b0cad8)
Bug: 557050400,553123003
Change-Id: Ib4fa0fad9a79369a7abfa0908d1fcc23d8b8e2ba
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8355367
Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com <chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Dominik Röttsches <drott@chromium.org>
Cr-Commit-Position: refs/branch-heads/8037@{#213}
Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415}
---
diff --git a/third_party/fontconfig/README.chromium b/third_party/fontconfig/README.chromium
index 54ced65..4c549ba 100644
--- a/third_party/fontconfig/README.chromium
+++ b/third_party/fontconfig/README.chromium
@@ -1,9 +1,9 @@
Name: fontconfig
URL: http://www.freedesktop.org/wiki/Software/fontconfig/
-Version: 2.18.1
-Revision: b707078e6e8bb6fd115e2080e69b3194c05e4f1c
+Version: 2.18.3
+Revision: d17ee184e436712c2abbe14a9c0ec02fb6acf5c5
Update Mechanism: Manual
-CPEPrefix: cpe:/a:fontconfig_project:fontconfig:2.18.1
+CPEPrefix: cpe:/a:fontconfig_project:fontconfig:2.18.3
License: HPND-sell-variant, MIT, MIT-Modern-Variant, Public-Domain-MD5, Public-Domain-ftglue, Unicode-TOU
License File: src/COPYING
Security Critical: yes
diff --git a/third_party/fontconfig/include/fc-genericfamily/fcgenericfamily.h b/third_party/fontconfig/include/fc-genericfamily/fcgenericfamily.h
index 0fab1735..1d05260 100644
--- a/third_party/fontconfig/include/fc-genericfamily/fcgenericfamily.h
+++ b/third_party/fontconfig/include/fc-genericfamily/fcgenericfamily.h
@@ -1,6 +1,6 @@
/* ANSI-C code produced by gperf version 3.3 */
/* Command-line: gperf --pic -m 100 --output-file fc-genericfamily/fcgenericfamily.h fc-genericfamily/fcgenericfamily.gperf */
-/* Computed positions: -k'1-2,4-5,8,10,12,14-17,20,$' */
+/* Computed positions: -k'1,3-5,8,10-18,20,$' */
#if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
&& ('%' == 37) && ('&' == 38) && ('\'' == 39) && ('(' == 40) \
@@ -42,12 +42,12 @@
struct FcGenericFamilyEntry;
#include <string.h>
-#define TOTAL_KEYWORDS 873
+#define TOTAL_KEYWORDS 1218
#define MIN_WORD_LENGTH 2
-#define MAX_WORD_LENGTH 31
-#define MIN_HASH_VALUE 40
-#define MAX_HASH_VALUE 5938
-/* maximum key range = 5899, duplicates = 0 */
+#define MAX_WORD_LENGTH 34
+#define MIN_HASH_VALUE 93
+#define MAX_HASH_VALUE 12005
+/* maximum key range = 11913, duplicates = 0 */
#ifndef GPERF_DOWNCASE
#define GPERF_DOWNCASE 1
@@ -102,32 +102,32 @@
{
static const unsigned short asso_values[] =
{
- 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939,
- 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939,
- 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939,
- 5939, 5939, 185, 1235, 5939, 5939, 5939, 5939, 5939, 5939,
- 12, 12, 5939, 39, 5939, 38, 5939, 5939, 11, 14,
- 13, 18, 47, 35, 11, 5939, 11, 12, 5939, 5939,
- 5939, 5939, 5939, 5939, 5939, 11, 1140, 403, 99, 28,
- 156, 146, 583, 12, 1406, 1075, 25, 19, 12, 14,
- 530, 14, 94, 80, 41, 13, 1709, 433, 71, 987,
- 398, 11, 5939, 5939, 5939, 11, 11, 11, 1140, 403,
- 99, 28, 156, 146, 583, 12, 1406, 1075, 25, 19,
- 12, 14, 530, 14, 94, 80, 41, 13, 1709, 433,
- 71, 987, 398, 11, 5939, 5939, 5939, 5939, 5939, 5939,
- 11, 12, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939,
- 5939, 5939, 11, 5939, 5939, 5939, 5939, 5939, 5939, 5939,
- 5939, 5939, 5939, 5939, 5939, 5939, 11, 11, 5939, 5939,
- 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 11, 12,
- 5939, 5939, 5939, 5939, 5939, 11, 5939, 5939, 5939, 5939,
- 11, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 11,
- 11, 5939, 5939, 5939, 5939, 11, 5939, 5939, 5939, 5939,
- 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939,
- 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939,
- 5939, 5939, 5939, 5939, 5939, 5939, 5939, 11, 5939, 5939,
- 11, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 11,
- 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939, 5939,
- 5939, 5939, 5939, 5939, 5939, 5939, 5939
+ 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006,
+ 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006,
+ 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006,
+ 12006, 12006, 25, 12006, 12006, 12006, 12006, 12006, 12006, 12006,
+ 18, 18, 12006, 12006, 12006, 18, 12006, 18, 30, 19,
+ 32, 19, 23, 25, 12006, 22, 20, 19, 12006, 12006,
+ 12006, 12006, 12006, 12006, 12006, 20, 2827, 129, 264, 43,
+ 1384, 353, 788, 18, 1347, 733, 249, 26, 18, 23,
+ 2269, 22, 20, 31, 53, 776, 3005, 2024, 2042, 1815,
+ 200, 12006, 12006, 12006, 12006, 18, 12006, 20, 2827, 129,
+ 264, 43, 1384, 353, 788, 18, 1347, 733, 249, 26,
+ 18, 23, 2269, 22, 20, 31, 53, 776, 3005, 2024,
+ 2042, 1815, 200, 12006, 12006, 12006, 12006, 12006, 12006, 12006,
+ 18, 18, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006,
+ 12006, 19, 19, 12006, 12006, 12006, 12006, 12006, 12006, 12006,
+ 12006, 12006, 12006, 12006, 12006, 12006, 19, 19, 12006, 12006,
+ 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 18, 12006,
+ 12006, 12006, 12006, 12006, 12006, 18, 12006, 12006, 12006, 12006,
+ 18, 12006, 12006, 18, 12006, 12006, 12006, 12006, 12006, 18,
+ 12006, 12006, 12006, 12006, 12006, 19, 12006, 12006, 12006, 12006,
+ 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006,
+ 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006,
+ 12006, 12006, 12006, 12006, 12006, 12006, 12006, 18, 12006, 12006,
+ 18, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 18,
+ 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006, 12006,
+ 12006, 12006, 12006, 12006, 12006, 12006
};
register unsigned int hval = len;
@@ -143,6 +143,13 @@
/*FALLTHROUGH*/
case 19:
case 18:
+ hval += asso_values[(unsigned char)str[17]];
+#if (defined __cplusplus && (__cplusplus >= 201703L || (__cplusplus >= 201103L && defined __clang__ && __clang_major__ + (__clang_minor__ >= 9) > 3))) || (defined __STDC_VERSION__ && __STDC_VERSION__ >= 202000L && ((defined __GNUC__ && __GNUC__ >= 10) || (defined __clang__ && __clang_major__ >= 9)))
+ [[fallthrough]];
+#elif (defined __GNUC__ && __GNUC__ >= 7) || (defined __clang__ && __clang_major__ >= 10)
+ __attribute__ ((__fallthrough__));
+#endif
+ /*FALLTHROUGH*/
case 17:
hval += asso_values[(unsigned char)str[16]];
#if (defined __cplusplus && (__cplusplus >= 201703L || (__cplusplus >= 201103L && defined __clang__ && __clang_major__ + (__clang_minor__ >= 9) > 3))) || (defined __STDC_VERSION__ && __STDC_VERSION__ >= 202000L && ((defined __GNUC__ && __GNUC__ >= 10) || (defined __clang__ && __clang_major__ >= 9)))
@@ -176,6 +183,13 @@
#endif
/*FALLTHROUGH*/
case 13:
+ hval += asso_values[(unsigned char)str[12]];
+#if (defined __cplusplus && (__cplusplus >= 201703L || (__cplusplus >= 201103L && defined __clang__ && __clang_major__ + (__clang_minor__ >= 9) > 3))) || (defined __STDC_VERSION__ && __STDC_VERSION__ >= 202000L && ((defined __GNUC__ && __GNUC__ >= 10) || (defined __clang__ && __clang_major__ >= 9)))
+ [[fallthrough]];
+#elif (defined __GNUC__ && __GNUC__ >= 7) || (defined __clang__ && __clang_major__ >= 10)
+ __attribute__ ((__fallthrough__));
+#endif
+ /*FALLTHROUGH*/
case 12:
hval += asso_values[(unsigned char)str[11]];
#if (defined __cplusplus && (__cplusplus >= 201703L || (__cplusplus >= 201103L && defined __clang__ && __clang_major__ + (__clang_minor__ >= 9) > 3))) || (defined __STDC_VERSION__ && __STDC_VERSION__ >= 202000L && ((defined __GNUC__ && __GNUC__ >= 10) || (defined __clang__ && __clang_major__ >= 9)))
@@ -185,6 +199,13 @@
#endif
/*FALLTHROUGH*/
case 11:
+ hval += asso_values[(unsigned char)str[10]];
+#if (defined __cplusplus && (__cplusplus >= 201703L || (__cplusplus >= 201103L && defined __clang__ && __clang_major__ + (__clang_minor__ >= 9) > 3))) || (defined __STDC_VERSION__ && __STDC_VERSION__ >= 202000L && ((defined __GNUC__ && __GNUC__ >= 10) || (defined __clang__ && __clang_major__ >= 9)))
+ [[fallthrough]];
+#elif (defined __GNUC__ && __GNUC__ >= 7) || (defined __clang__ && __clang_major__ >= 10)
+ __attribute__ ((__fallthrough__));
+#endif
+ /*FALLTHROUGH*/
case 10:
hval += asso_values[(unsigned char)str[9]];
#if (defined __cplusplus && (__cplusplus >= 201703L || (__cplusplus >= 201103L && defined __clang__ && __clang_major__ + (__clang_minor__ >= 9) > 3))) || (defined __STDC_VERSION__ && __STDC_VERSION__ >= 202000L && ((defined __GNUC__ && __GNUC__ >= 10) || (defined __clang__ && __clang_major__ >= 9)))
@@ -205,7 +226,7 @@
case 7:
case 6:
case 5:
- hval += asso_values[(unsigned char)str[4]+1];
+ hval += asso_values[(unsigned char)str[4]];
#if (defined __cplusplus && (__cplusplus >= 201703L || (__cplusplus >= 201103L && defined __clang__ && __clang_major__ + (__clang_minor__ >= 9) > 3))) || (defined __STDC_VERSION__ && __STDC_VERSION__ >= 202000L && ((defined __GNUC__ && __GNUC__ >= 10) || (defined __clang__ && __clang_major__ >= 9)))
[[fallthrough]];
#elif (defined __GNUC__ && __GNUC__ >= 7) || (defined __clang__ && __clang_major__ >= 10)
@@ -221,14 +242,14 @@
#endif
/*FALLTHROUGH*/
case 3:
- case 2:
- hval += asso_values[(unsigned char)str[1]];
+ hval += asso_values[(unsigned char)str[2]];
#if (defined __cplusplus && (__cplusplus >= 201703L || (__cplusplus >= 201103L && defined __clang__ && __clang_major__ + (__clang_minor__ >= 9) > 3))) || (defined __STDC_VERSION__ && __STDC_VERSION__ >= 202000L && ((defined __GNUC__ && __GNUC__ >= 10) || (defined __clang__ && __clang_major__ >= 9)))
[[fallthrough]];
#elif (defined __GNUC__ && __GNUC__ >= 7) || (defined __clang__ && __clang_major__ >= 10)
__attribute__ ((__fallthrough__));
#endif
/*FALLTHROUGH*/
+ case 2:
case 1:
hval += asso_values[(unsigned char)str[0]];
break;
@@ -238,1755 +259,2445 @@
struct FcConstFamilyNamePool_t
{
- char FcConstFamilyNamePool_str40[sizeof("nu")];
- char FcConstFamilyNamePool_str53[sizeof("aqui")];
- char FcConstFamilyNamePool_str60[sizeof("muli")];
- char FcConstFamilyNamePool_str64[sizeof("untaza")];
- char FcConstFamilyNamePool_str65[sizeof("loma")];
- char FcConstFamilyNamePool_str68[sizeof("lato")];
- char FcConstFamilyNamePool_str70[sizeof("nunito")];
- char FcConstFamilyNamePool_str71[sizeof("nasim")];
- char FcConstFamilyNamePool_str72[sizeof("madan")];
- char FcConstFamilyNamePool_str73[sizeof("navilu")];
- char FcConstFamilyNamePool_str74[sizeof("madan2")];
- char FcConstFamilyNamePool_str75[sizeof("unbom")];
- char FcConstFamilyNamePool_str77[sizeof("andika")];
- char FcConstFamilyNamePool_str78[sizeof("undotum")];
- char FcConstFamilyNamePool_str79[sizeof("tiza")];
- char FcConstFamilyNamePool_str81[sizeof("unvada")];
- char FcConstFamilyNamePool_str84[sizeof("unpen")];
- char FcConstFamilyNamePool_str85[sizeof("undinaru")];
- char FcConstFamilyNamePool_str86[sizeof("unpilgia")];
- char FcConstFamilyNamePool_str88[sizeof("uniol")];
- char FcConstFamilyNamePool_str93[sizeof("mononoki")];
- char FcConstFamilyNamePool_str94[sizeof("unjamosora")];
- char FcConstFamilyNamePool_str95[sizeof("tahoma")];
- char FcConstFamilyNamePool_str96[sizeof("norasi")];
- char FcConstFamilyNamePool_str97[sizeof("lime")];
- char FcConstFamilyNamePool_str98[sizeof("alkalami")];
- char FcConstFamilyNamePool_str100[sizeof("elham")];
- char FcConstFamilyNamePool_str101[sizeof("\357\275\215\357\275\223 \346\230\216\346\234\235")];
- char FcConstFamilyNamePool_str102[sizeof("m+ 1mn")];
- char FcConstFamilyNamePool_str103[sizeof("ungungseo")];
- char FcConstFamilyNamePool_str105[sizeof("unjamodotum")];
- char FcConstFamilyNamePool_str106[sizeof("molot")];
- char FcConstFamilyNamePool_str107[sizeof("m+ 2m")];
- char FcConstFamilyNamePool_str108[sizeof("m+ 1m")];
- char FcConstFamilyNamePool_str109[sizeof("andale mono")];
- char FcConstFamilyNamePool_str117[sizeof("asea")];
- char FcConstFamilyNamePool_str118[sizeof("sina")];
- char FcConstFamilyNamePool_str122[sizeof("unpenheulim")];
- char FcConstFamilyNamePool_str123[sizeof("lohit tamil")];
- char FcConstFamilyNamePool_str124[sizeof("unyetgul")];
- char FcConstFamilyNamePool_str125[sizeof("titillium")];
- char FcConstFamilyNamePool_str126[sizeof("unjamonovel")];
- char FcConstFamilyNamePool_str134[sizeof("roya")];
- char FcConstFamilyNamePool_str137[sizeof("lohit gujarati")];
- char FcConstFamilyNamePool_str139[sizeof("lohit nepali")];
- char FcConstFamilyNamePool_str140[sizeof("inconsolata")];
- char FcConstFamilyNamePool_str143[sizeof("lohit telugu")];
- char FcConstFamilyNamePool_str148[sizeof("aroania")];
- char FcConstFamilyNamePool_str150[sizeof("tabassom")];
- char FcConstFamilyNamePool_str153[sizeof("\357\275\215\357\275\223 \343\202\264\343\202\267\343\203\203\343\202\257")];
- char FcConstFamilyNamePool_str155[sizeof("roboto")];
- char FcConstFamilyNamePool_str160[sizeof("musica")];
- char FcConstFamilyNamePool_str161[sizeof("lohit malayalam")];
- char FcConstFamilyNamePool_str164[sizeof("albany amt")];
- char FcConstFamilyNamePool_str165[sizeof("arial")];
- char FcConstFamilyNamePool_str166[sizeof("lohit maithili")];
- char FcConstFamilyNamePool_str170[sizeof("edwin")];
- char FcConstFamilyNamePool_str171[sizeof("nsimsun")];
- char FcConstFamilyNamePool_str172[sizeof("smoothansi")];
- char FcConstFamilyNamePool_str175[sizeof("literata")];
- char FcConstFamilyNamePool_str180[sizeof("d-din")];
- char FcConstFamilyNamePool_str183[sizeof("leland")];
- char FcConstFamilyNamePool_str188[sizeof("impact")];
- char FcConstFamilyNamePool_str190[sizeof("gohu")];
- char FcConstFamilyNamePool_str191[sizeof("roboto mono")];
- char FcConstFamilyNamePool_str193[sizeof("tinos")];
- char FcConstFamilyNamePool_str195[sizeof("lohit odia")];
- char FcConstFamilyNamePool_str198[sizeof("lohit hindi")];
- char FcConstFamilyNamePool_str203[sizeof("david clm")];
- char FcConstFamilyNamePool_str207[sizeof("times")];
- char FcConstFamilyNamePool_str210[sizeof("lohit kannada")];
- char FcConstFamilyNamePool_str211[sizeof("lohit sindhi")];
- char FcConstFamilyNamePool_str215[sizeof("garuda")];
- char FcConstFamilyNamePool_str216[sizeof("mingliu")];
- char FcConstFamilyNamePool_str223[sizeof("agbalumo")];
- char FcConstFamilyNamePool_str229[sizeof("oswald")];
- char FcConstFamilyNamePool_str231[sizeof("inter")];
- char FcConstFamilyNamePool_str234[sizeof("analecta")];
- char FcConstFamilyNamePool_str236[sizeof("mingzat")];
- char FcConstFamilyNamePool_str238[sizeof("irannastaliq")];
- char FcConstFamilyNamePool_str242[sizeof("leland text")];
- char FcConstFamilyNamePool_str243[sizeof("liberation mono")];
- char FcConstFamilyNamePool_str245[sizeof("titr")];
- char FcConstFamilyNamePool_str253[sizeof("lohit assamese")];
- char FcConstFamilyNamePool_str258[sizeof("aurulentsansmono")];
- char FcConstFamilyNamePool_str259[sizeof("lohit devanagari")];
- char FcConstFamilyNamePool_str260[sizeof("tlwgmono")];
- char FcConstFamilyNamePool_str261[sizeof("tlwgtypo")];
- char FcConstFamilyNamePool_str267[sizeof("stix")];
- char FcConstFamilyNamePool_str274[sizeof("infofont")];
- char FcConstFamilyNamePool_str281[sizeof("edges")];
- char FcConstFamilyNamePool_str284[sizeof("latin modern roman")];
- char FcConstFamilyNamePool_str288[sizeof("lohit bengali")];
- char FcConstFamilyNamePool_str291[sizeof("inconsolatago")];
- char FcConstFamilyNamePool_str292[sizeof("alegreya")];
- char FcConstFamilyNamePool_str294[sizeof("monofur")];
- char FcConstFamilyNamePool_str295[sizeof("annapurna sil")];
- char FcConstFamilyNamePool_str301[sizeof("montserrat")];
- char FcConstFamilyNamePool_str303[sizeof("anorexia")];
- char FcConstFamilyNamePool_str305[sizeof("sniglet")];
- char FcConstFamilyNamePool_str310[sizeof("segoe ui")];
- char FcConstFamilyNamePool_str313[sizeof("geist")];
- char FcConstFamilyNamePool_str319[sizeof("geist mono")];
- char FcConstFamilyNamePool_str320[sizeof("exo 2")];
- char FcConstFamilyNamePool_str324[sizeof("intel one mono")];
- char FcConstFamilyNamePool_str326[sizeof("freemono")];
- char FcConstFamilyNamePool_str327[sizeof("libertinus")];
- char FcConstFamilyNamePool_str328[sizeof("fixed")];
- char FcConstFamilyNamePool_str329[sizeof("tlwgtypist")];
- char FcConstFamilyNamePool_str333[sizeof("mints mild")];
- char FcConstFamilyNamePool_str340[sizeof("signfont")];
- char FcConstFamilyNamePool_str341[sizeof("arundina sans")];
- char FcConstFamilyNamePool_str342[sizeof("anka/coder")];
- char FcConstFamilyNamePool_str345[sizeof("inconsolata go")];
- char FcConstFamilyNamePool_str349[sizeof("unbatang")];
... (file diff truncated)
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page