Skip to content

fix(deps): update module github.com/go-opentype/opentype to v0.13.0 - #12

Merged
tannevaled merged 1 commit into
mainfrom
renovate/deps
Sep 27, 2026
Merged

tannevaled merged 1 commit into
mainfrom
renovate/deps

Conversation

@tannevaled

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/go-opentype/opentype v0.12.0 → v0.13.0 age confidence

Release Notes

go-opentype/opentype (github.com/go-opentype/opentype)

v0.13.0: — a ceiling that a 32-bit int walked through

Compare Source

Judge a table's extent in int64

The table-directory reader refused an out-of-range table by adding two uint32s
converted with int():

off := int(be32(rec[8:]))
length := int(be32(rec[12:]))
if off+length > len(b) {

int is 32 bits on a 32-bit build, so a length of 0xFFFFFFFF becomes −1.
off+length then comes out smaller than off, the check passes a table that
is not in the file, and the slice that follows panics — b[184:183] — in a
reader whose whole purpose is to refuse a malformed font rather than crash on one.

TestParseErrors/table_out_of_range already covered this and was already
correct. It had simply never been run on a machine where an int is 32 bits.

New: the tests run on six architectures

riscv64, loong64, ppc64le, s390x (big-endian), 386 and arm (32-bit
int) — under qemu-user-static, except 386, which runs natively because
qemu-i386 loses the guest's floating-point state across the signal Go delivers
for asynchronous preemption (5 failures in 8 identical lanes emulated, 0 in 8
native).

The CI previously cross-compiled for the 64-bit four and ran on none of them.
Every big-endian lane was green from the first run — a font file is a big-endian
container, so the readers had nothing to unlearn. Both 32-bit lanes failed, and
the fix above is what they found.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@tannevaled
tannevaled merged commit a036bb9 into main Sep 27, 2026
1 check passed
@tannevaled
tannevaled deleted the renovate/deps branch September 27, 2026 17:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant