[read-fonts] fix overflow in charstring eval

read-fonts/src/tables/postscript/charstring.rs

@@ -361,7 +361,8 @@ where
                     self.y += self.stack.get_fixed(0)?;
                     self.stack_ix = 1;
                 }
-                while self.coords_remaining() > 0 {
+                // We need at least 4 coordinates to emit these curves
+                while self.coords_remaining() >= 4 {
                     self.emit_curves([DxY, DxDy, DxY])?;
                 }
                 self.reset_stack();
@@ -448,7 +449,10 @@ where
     }
 
     fn coords_remaining(&self) -> usize {
-        self.stack.len() - self.stack_ix
+        // This is overly defensive to avoid overflow but in the case of
+        // broken fonts, just return 0 when stack_ix > stack_len to prevent
+        // potential runaway while loops in the evaluator if this wraps
+        self.stack.len().saturating_sub(self.stack_ix)
     }
 
     fn emit_curves<const N: usize>(&mut self, modes: [PointMode; N]) -> Result<(), Error> {
@@ -1011,4 +1015,19 @@ mod tests {
         ];
         assert_eq!(&commands.0, expected);
     }
+
+    /// Fuzzer caught subtract with overflow
+    /// <https://g-issues.oss-fuzz.com/issues/383609770>
+    #[test]
+    fn coords_remaining_avoid_overflow() {
+        // Test case:
+        // Evaluate HHCURVETO operator with 2 elements on the stack
+        let mut commands = CaptureCommandSink::default();
+        let mut evaluator = Evaluator::new(Index::Empty, None, None, &mut commands);
+        evaluator.stack.push(0).unwrap();
+        evaluator.stack.push(0).unwrap();
+        let mut cursor = FontData::new(&[]).cursor();
+        // Just don't panic
+        let _ = evaluator.evaluate_operator(Operator::HhCurveTo, &mut cursor, 0);
+    }
 }