From 79ab7c170d8c6b6d3b148f983121717e71fefeea Mon Sep 17 00:00:00 2001 From: Konstantin Ritt Date: Fri, 25 May 2012 06:23:15 +0300 Subject: Fix potential access beyond the array end addNextCluster() advances position up to "end" that equals to eng->layoutData->string.length() if current script item is the last one Change-Id: I173286f3002c9c64dd1a89b902958699b6273d68 Reviewed-by: Jiang Jiang --- src/gui/text/qtextlayout.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/gui/text/qtextlayout.cpp b/src/gui/text/qtextlayout.cpp index 43d212f394..3cdd54627e 100644 --- a/src/gui/text/qtextlayout.cpp +++ b/src/gui/text/qtextlayout.cpp @@ -1865,7 +1865,9 @@ void QTextLine::layout_helper(int maxGlyphs) addNextCluster(lbh.currentPosition, end, lbh.tmpData, lbh.glyphCount, current, lbh.logClusters, lbh.glyphs); - if (attributes[lbh.currentPosition].whiteSpace || attributes[lbh.currentPosition-1].lineBreakType != HB_NoBreak) { + if (lbh.currentPosition >= eng->layoutData->string.length() + || attributes[lbh.currentPosition].whiteSpace + || attributes[lbh.currentPosition-1].lineBreakType != HB_NoBreak) { sb_or_ws = true; break; } else if (breakany && attributes[lbh.currentPosition].charStop) { -- cgit v1.2.3