diff --git a/cve_bin_tool/checkers/harfbuzz.py b/cve_bin_tool/checkers/harfbuzz.py index 653354c694..6c01418ca4 100644 --- a/cve_bin_tool/checkers/harfbuzz.py +++ b/cve_bin_tool/checkers/harfbuzz.py @@ -15,9 +15,14 @@ class HarfbuzzChecker(Checker): CONTAINS_PATTERNS: list[str] = [] - FILENAME_PATTERNS: list[str] = [] + FILENAME_PATTERNS: list[str] = [r"libharfbuzz"] VERSION_PATTERNS = [ - r"HB_OPTIONS\r?\nuniscribe-bug-compatible\r?\ninvalid\r?\n([0-9]+\.[0-9]+\.[0-9]+)", - r"([0-9]+\.[0-9]+\.[0-9]+)\r?\nHarfBuzz", + r"HB_OPTIONS[\x00\r\n]+uniscribe-bug-compatible[\x00\r\n]+invalid[\x00\r\n]+([0-9]+\.[0-9]+\.[0-9]+)", + r"([0-9]+\.[0-9]+\.[0-9]+)[\x00\r\n]+HarfBuzz", + r"HB_OPTIONS[\x00\r\n]+uniscribe-bug-compatible[\x00\r\n]+([0-9]+\.[0-9]+\.[0-9]+)", + r"json[\x00\r\n]+([0-9]+\.[0-9]+\.[0-9]+)", + r"end table morx[\x00\r\n]+([0-9]+\.[0-9]+\.[0-9]+)[\x00\r\n]+replacing glyph", + r"<%d,%d,%d,%d>[\x00\r\n]+([0-9]+\.[0-9]+\.[0-9]+)[\x00\r\n]+start table", + r"@%d,%d[\x00\r\n]+([0-9]+\.[0-9]+\.[0-9]+)[\x00\r\n]+end table", ] VENDOR_PRODUCT = [("harfbuzz_project", "harfbuzz")] diff --git a/test/test_data/harfbuzz.py b/test/test_data/harfbuzz.py index 3111fcaff9..6150cf5a62 100644 --- a/test/test_data/harfbuzz.py +++ b/test/test_data/harfbuzz.py @@ -8,6 +8,38 @@ "version_strings": ["HB_OPTIONS\nuniscribe-bug-compatible\ninvalid\n7.0.0"], }, {"product": "harfbuzz", "version": "1.4.2", "version_strings": ["1.4.2\nHarfBuzz"]}, + { + "product": "harfbuzz", + "version": "1.4.2", + "version_strings": [ + "HB_OPTIONS\x00uniscribe-bug-compatible\x00invalid\x001.4.2" + ], + }, + { + "product": "harfbuzz", + "version": "2.3.0", + "version_strings": ["HB_OPTIONS\x00uniscribe-bug-compatible\x002.3.0"], + }, + { + "product": "harfbuzz", + "version": "2.6.4", + "version_strings": ["json\x002.6.4"], + }, + { + "product": "harfbuzz", + "version": "6.0.0", + "version_strings": ["end table morx\x006.0.0\x00replacing glyph"], + }, + { + "product": "harfbuzz", + "version": "8.2.2", + "version_strings": ["<%d,%d,%d,%d>\x008.2.2\x00start table"], + }, + { + "product": "harfbuzz", + "version": "10.2.0", + "version_strings": ["@%d,%d\x0010.2.0\x00end table"], + }, ] package_test_data = [ {