Skip to content

W
wine-winehq
Commit 1b02c1ac authored by Henri Verbeet's avatar Henri Verbeet Committed by Alexandre Julliard
Browse files
Options

usp10: Range check glyph counts in GPOS_apply_ContextPos().

Signed-off-by: 's avatarHenri Verbeet <hverbeet@codeweavers.com> Signed-off-by: 's avatarAric Stewart <aric@codeweavers.com> Signed-off-by: 's avatarAlexandre Julliard <julliard@winehq.org>
parent d1ca880e
Hide whitespace changes
Inline Side-by-side
Showing with 6 additions and 0 deletions
dlls/usp10/opentype.c
View file @ 1b02c1ac
...@@ -2166,12 +2166,18 @@ static unsigned int GPOS_apply_ContextPos(const ScriptCache *script_cache, const ...@@ -2166,12 +2166,18 @@ static unsigned int GPOS_apply_ContextPos(const ScriptCache *script_cache, const
{ {
const GPOS_PosClassRule_1 *pr; const GPOS_PosClassRule_1 *pr;
const GPOS_PosClassRule_2 *pr_2; const GPOS_PosClassRule_2 *pr_2;
unsigned int g;
int g_count, l; int g_count, l;
offset = GET_BE_WORD(pcs->PosClassRule[k]); offset = GET_BE_WORD(pcs->PosClassRule[k]);
pr = (const GPOS_PosClassRule_1*)((const BYTE*)pcs+offset); pr = (const GPOS_PosClassRule_1*)((const BYTE*)pcs+offset);
g_count = GET_BE_WORD(pr->GlyphCount); g_count = GET_BE_WORD(pr->GlyphCount);
TRACE("PosClassRule has %i glyphs classes\n",g_count); TRACE("PosClassRule has %i glyphs classes\n",g_count);
g = glyph_index + write_dir * (g_count - 1);
if (g >= glyph_count)
continue;
for (l = 0; l < g_count-1; l++) for (l = 0; l < g_count-1; l++)
{ {
int g_class = OT_get_glyph_class(glyph_class_table, glyphs[glyph_index + (write_dir * (l+1))]); int g_class = OT_get_glyph_class(glyph_class_table, glyphs[glyph_index + (write_dir * (l+1))]);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment