diff options
Diffstat (limited to 'src/3rdparty/harfbuzz-ng/src/hb-blob.cc')
-rw-r--r-- | src/3rdparty/harfbuzz-ng/src/hb-blob.cc | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/3rdparty/harfbuzz-ng/src/hb-blob.cc b/src/3rdparty/harfbuzz-ng/src/hb-blob.cc index b82b4b2a3a..8759a252a5 100644 --- a/src/3rdparty/harfbuzz-ng/src/hb-blob.cc +++ b/src/3rdparty/harfbuzz-ng/src/hb-blob.cc @@ -78,8 +78,8 @@ _hb_blob_destroy_user_data (hb_blob_t *blob) } /** - * hb_blob_create: (Xconstructor) - * @data: (array length=length) (closure user_data) (destroy destroy) (scope notified) (transfer none): Pointer to blob data. + * hb_blob_create: (skip) + * @data: Pointer to blob data. * @length: Length of @data in bytes. * @mode: Memory mode for @data. * @user_data: Data parameter to pass to @destroy. @@ -102,7 +102,10 @@ hb_blob_create (const char *data, { hb_blob_t *blob; - if (!length || !(blob = hb_object_create<hb_blob_t> ())) { + if (!length || + length >= 1u << 31 || + data + length < data /* overflows */ || + !(blob = hb_object_create<hb_blob_t> ())) { if (destroy) destroy (user_data); return hb_blob_get_empty (); |