dwrite: Disallow recursing to reverse chaining substitution.

Signed-off-by: Nikolay Sivov <nsivov@codeweavers.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

dwrite: Disallow recursing to reverse chaining substitution.
fb5eec2c · Nikolay Sivov · Alexandre Julliard · 3c415128 · fb5eec2c
Commit fb5eec2c authored Jun 09, 2020 by Nikolay Sivov Committed by Alexandre Julliard Jun 09, 2020
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 0 deletions

opentype.c dlls/dwrite/opentype.c +3 -0

No files found.
--- a/dlls/dwrite/opentype.c
+++ b/dlls/dwrite/opentype.c
@@ -5482,6 +5482,9 @@ static BOOL opentype_layout_apply_gsub_reverse_chain_context_substitution(struct
    unsigned int offset = subtable_offset;
    UINT16 glyph, format;

+    if (context->nesting_level_left != SHAPE_MAX_NESTING_LEVEL)
+        return FALSE;
+
    glyph = context->u.subst.glyphs[context->cur];

    format = table_read_be_word(table, offset);