diff options
author | John Tapsell <john.tapsell.ext@basyskom.com> | 2012-03-14 15:49:07 +0000 |
---|---|---|
committer | Qt by Nokia <qt-info@nokia.com> | 2012-04-02 14:52:48 +0200 |
commit | 97282527ae7f1c97d6ca3cfeee61c4bacb30832f (patch) | |
tree | ed61ba12eeea650f08808a20ece311abd4e93787 /src/3rdparty | |
parent | c82d40749dc1ce816333e84d7f3232e59fbe2058 (diff) |
Harfbuzz-thai - fix buffer overflow when setting item attributes
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@nokia.com>
Change-Id: I92de853b57e2e06211193a2b30ac7c308374c961
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@nokia.com>
Diffstat (limited to 'src/3rdparty')
-rw-r--r-- | src/3rdparty/harfbuzz/src/harfbuzz-thai.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-thai.c b/src/3rdparty/harfbuzz/src/harfbuzz-thai.c index bf6c35b19c..3c0ffe8358 100644 --- a/src/3rdparty/harfbuzz/src/harfbuzz-thai.c +++ b/src/3rdparty/harfbuzz/src/harfbuzz-thai.c @@ -263,8 +263,13 @@ static HB_Bool HB_ThaiConvertStringToGlyphIndices (HB_ShaperItem *item) // The only glyphs that should be passed to this function that cannot be mapped to // tis620 are the ones of type Inherited class. Pass these glyphs untouched. glyphString[slen++] = string[i]; - if (string[i] == 0x200D || string[i] == 0x200C) - item->attributes[slen-1].dontPrint = true; // Hide ZWJ and ZWNJ characters + if (string[i] == 0x200D || string[i] == 0x200C) { + // Check that we do not run out of bounds when setting item->attributes. If we do + // run out of bounds then this function will return false, the necessary amount of + // memory is reallocated, and this function will then be called again. + if (slen <= item->num_glyphs) + item->attributes[slen-1].dontPrint = true; // Hide ZWJ and ZWNJ characters + } } else { glyphString[slen++] = (HB_UChar16) thai_get_glyph_index (font_type, rglyphs[lgi]); } |