summaryrefslogtreecommitdiffstats
path: root/src/3rdparty
diff options
context:
space:
mode:
authorJohn Tapsell <john.tapsell.ext@basyskom.com>2012-03-12 22:07:47 (GMT)
committerQt by Nokia <qt-info@nokia.com>2012-03-14 09:30:17 (GMT)
commit827e5c4c689d4ecb4f8c1ab48c9a7ab712fe2ca7 (patch)
tree4c150ef1288d6e70e2188d1ddf35008823eb7ed6 /src/3rdparty
parent1d1b1391d81bd4328de5c4818e86a91fb8fe5133 (diff)
downloadQt-827e5c4c689d4ecb4f8c1ab48c9a7ab712fe2ca7.zip
Qt-827e5c4c689d4ecb4f8c1ab48c9a7ab712fe2ca7.tar.gz
Qt-827e5c4c689d4ecb4f8c1ab48c9a7ab712fe2ca7.tar.bz2
Harfbuzz-thai - fix buffer overflow when setting item attributes
Change-Id: I19eeb4ec25a7c6cb3f584e6290169f9f327b8713 Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@nokia.com>
Diffstat (limited to 'src/3rdparty')
-rw-r--r--src/3rdparty/harfbuzz/src/harfbuzz-thai.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-thai.c b/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
index bf6c35b..3c0ffe8 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
@@ -263,8 +263,13 @@ static HB_Bool HB_ThaiConvertStringToGlyphIndices (HB_ShaperItem *item)
// The only glyphs that should be passed to this function that cannot be mapped to
// tis620 are the ones of type Inherited class. Pass these glyphs untouched.
glyphString[slen++] = string[i];
- if (string[i] == 0x200D || string[i] == 0x200C)
- item->attributes[slen-1].dontPrint = true; // Hide ZWJ and ZWNJ characters
+ if (string[i] == 0x200D || string[i] == 0x200C) {
+ // Check that we do not run out of bounds when setting item->attributes. If we do
+ // run out of bounds then this function will return false, the necessary amount of
+ // memory is reallocated, and this function will then be called again.
+ if (slen <= item->num_glyphs)
+ item->attributes[slen-1].dontPrint = true; // Hide ZWJ and ZWNJ characters
+ }
} else {
glyphString[slen++] = (HB_UChar16) thai_get_glyph_index (font_type, rglyphs[lgi]);
}