diff options
| author | Etienne Bergeron <etienneb@chromium.org> | 2022-07-19 16:46:43 +0000 |
|---|---|---|
| committer | Michael Brüning <michael.bruning@qt.io> | 2022-08-03 10:14:37 +0000 |
| commit | abd27ffc3addcbbea533b99212702064377f322e (patch) | |
| tree | 76a3e8813935e8f0078a3f7b1dce4fce1842036d /chromium | |
| parent | 26a4642061b331931a6026dc70ef37808b310bfd (diff) | |
[Backport] Security bug 1287804
Manual cherry-pick of patch originally reviewed
https://chromium-review.googlesource.com/c/chromium/src/+/3726349:
Fix incorrect text itemization for \r codepoint
M96 merge issues:
render_text_unittest.cc
Tests Clusterfuzz_Issue_1298286/1299054 aren't present
in M96 and caused a merge conflict.
The "\r" codepoint should be split to be rendered in a single
harfbuzz run (same as "\n").
We do recognize these sequences as newline:
\r
\n
\r\n
Previously, the itemization will leave the "\r" with the previous
run. This is leading to incorrect multiline lines splitting.
(cherry picked from commit eee0c5ca752ad50df9986c551cb98226ce078893)
Bug: 1287804
Change-Id: Idfc00a3cf147eb53258d5da9ea105e2d6dc25f05
Commit-Queue: Etienne Bergeron <etienneb@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1014955}
Reviewed-by: Etienne Bergeron <etienneb@chromium.org>
Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com>
Cr-Commit-Position: refs/branch-heads/4664@{#1662}
Cr-Branched-From: 24dc4ee75e01a29d390d43c9c264372a169273a7-refs/heads/main@{#929512}
Reviewed-by: Michal Klocek <michal.klocek@qt.io>
Diffstat (limited to 'chromium')
| -rw-r--r-- | chromium/ui/gfx/render_text_harfbuzz.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/chromium/ui/gfx/render_text_harfbuzz.cc b/chromium/ui/gfx/render_text_harfbuzz.cc index 02c97762835..14dcb4f1792 100644 --- a/chromium/ui/gfx/render_text_harfbuzz.cc +++ b/chromium/ui/gfx/render_text_harfbuzz.cc @@ -201,7 +201,7 @@ GraphemeProperties RetrieveGraphemeProperties(const base::StringPiece16& text, properties.block = ublock_getCode(codepoint); } - if (codepoint == '\n' || codepoint == ' ') + if (codepoint == '\n' || codepoint == '\r' || codepoint == ' ') properties.has_control = true; if (IsBracket(codepoint)) properties.has_bracket = true; |