Merge remote-tracking branch 'origin/master' into api_changes

Conflicts:
	configure
	src/widgets/styles/qwindowsxpstyle.cpp
	tests/auto/gui/kernel/qwindow/qwindow.pro
	tests/auto/gui/kernel/qwindow/tst_qwindow.cpp

Change-Id: I624b6d26abce9874c610c04954c1c45bc074bef3

1 files changed, 7 insertions, 2 deletions

diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-thai.c b/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
index bf6c35b19c..3c0ffe8358 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
@@ -263,8 +263,13 @@ static HB_Bool HB_ThaiConvertStringToGlyphIndices (HB_ShaperItem *item)
                 // The only glyphs that should be passed to this function that cannot be mapped to
                 // tis620 are the ones of type Inherited class.  Pass these glyphs untouched.
                 glyphString[slen++] = string[i];
-                if (string[i] == 0x200D || string[i] == 0x200C)
-                    item->attributes[slen-1].dontPrint = true; // Hide ZWJ and ZWNJ characters
+                if (string[i] == 0x200D || string[i] == 0x200C) {
+                    // Check that we do not run out of bounds when setting item->attributes.  If we do
+                    // run out of bounds then this function will return false, the necessary amount of
+                    // memory is reallocated, and this function will then be called again.
+                    if (slen <= item->num_glyphs)
+                        item->attributes[slen-1].dontPrint = true; // Hide ZWJ and ZWNJ characters
+                }
             } else {
                 glyphString[slen++] = (HB_UChar16) thai_get_glyph_index (font_type, rglyphs[lgi]);
             }