summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPeter Breitenlohner <peb@mppmu.mpg.de>2011-02-22 09:58:08 +0000
committerPeter Breitenlohner <peb@mppmu.mpg.de>2011-02-22 09:58:08 +0000
commit146759c9521ba1de269f5248b2f5fd09fd3bc003 (patch)
treec0f038672cab9b8458769de567d3faf466fe6b38
parent07d53c40eed683d8cd67a30bf6c5dc750a5c73e5 (diff)
Avoid possible array bounds violation
git-svn-id: svn://tug.org/texlive/trunk@21498 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Build/source/libs/icu/icu-4.6-PATCHES/ChangeLog4
-rw-r--r--Build/source/libs/icu/icu-4.6-PATCHES/patch-81-Indic56
-rw-r--r--Build/source/libs/icu/icu-4.6/layout/IndicReordering.cpp8
-rw-r--r--Build/source/libs/icu/icu-4.6/layout/IndicReordering.h5
4 files changed, 68 insertions, 5 deletions
diff --git a/Build/source/libs/icu/icu-4.6-PATCHES/ChangeLog b/Build/source/libs/icu/icu-4.6-PATCHES/ChangeLog
index b90685be95a..f9afa564918 100644
--- a/Build/source/libs/icu/icu-4.6-PATCHES/ChangeLog
+++ b/Build/source/libs/icu/icu-4.6-PATCHES/ChangeLog
@@ -1,3 +1,7 @@
+2011-02-22 Peter Breitenlohner <peb@mppmu.mpg.de>
+
+ * patch-81-Indic (new): IndicReordering.*: Respect array bounds.
+
2010-12-07 Peter Breitenlohner <peb@mppmu.mpg.de>
* patch-11-CURR_FULL_DIR: Correctly handle CURR_FULL_DIR when
diff --git a/Build/source/libs/icu/icu-4.6-PATCHES/patch-81-Indic b/Build/source/libs/icu/icu-4.6-PATCHES/patch-81-Indic
new file mode 100644
index 00000000000..4e50d93022a
--- /dev/null
+++ b/Build/source/libs/icu/icu-4.6-PATCHES/patch-81-Indic
@@ -0,0 +1,56 @@
+ Make sure the loop over SplitMatra pieces stays within array bounds.
+
+ Remove some trailing white space.
+
+diff -ur icu-4.6.orig/source/layout/IndicReordering.cpp icu-4.6/source/layout/IndicReordering.cpp
+--- icu-4.6.orig/source/layout/IndicReordering.cpp 2009-10-08 21:13:13.000000000 +0200
++++ icu-4.6/source/layout/IndicReordering.cpp 2011-02-22 10:35:06.000000000 +0100
+@@ -235,13 +235,13 @@
+
+ for ( i = beginSyllable ; i < nextSyllable ; i++ ) {
+ if ( classTable->isMatra(fOutChars[i+inv_count])) {
+- IndicClassTable::CharClass matraClass = classTable->getCharClass(fOutChars[i+inv_count]);
++ IndicClassTable::CharClass matraClass = classTable->getCharClass(fOutChars[i+inv_count]);
+ if ( classTable->isSplitMatra(matraClass)) {
+ le_int32 saveIndex = fGlyphStorage.getCharIndex(i+inv_count,success);
+ le_uint32 saveAuxData = fGlyphStorage.getAuxData(i+inv_count,success);
+ const SplitMatra *splitMatra = classTable->getSplitMatra(matraClass);
+ int j;
+- for (j = 0 ; *(splitMatra)[j] != 0 ; j++) {
++ for (j = 0 ; j < SM_MAX_PIECES && *(splitMatra)[j] != 0 ; j++) {
+ LEUnicode piece = (*splitMatra)[j];
+ if ( j == 0 ) {
+ fOutChars[i+inv_count] = piece;
+@@ -252,7 +252,7 @@
+ }
+ }
+ }
+-
++
+ if ((matraClass & CF_POS_MASK) == CF_POS_BEFORE) {
+ moveCharacter(i+inv_count,beginSyllable+inv_count);
+ }
+@@ -332,7 +332,7 @@
+ const SplitMatra *splitMatra = classTable->getSplitMatra(matraClass);
+ int i;
+
+- for (i = 0; i < 3 && (*splitMatra)[i] != 0; i += 1) {
++ for (i = 0; i < SM_MAX_PIECES && (*splitMatra)[i] != 0; i += 1) {
+ LEUnicode piece = (*splitMatra)[i];
+ IndicClassTable::CharClass pieceClass = classTable->getCharClass(piece);
+
+diff -ur icu-4.6.orig/source/layout/IndicReordering.h icu-4.6/source/layout/IndicReordering.h
+--- icu-4.6.orig/source/layout/IndicReordering.h 2009-06-11 20:34:01.000000000 +0200
++++ icu-4.6/source/layout/IndicReordering.h 2011-02-22 10:22:43.000000000 +0100
+@@ -71,7 +71,10 @@
+ #define SF_POST_BASE_LIMIT_MASK 0x0000FFFFU
+ #define SF_NO_POST_BASE_LIMIT 0x00007FFFU
+
+-typedef LEUnicode SplitMatra[3];
++// Max number of split matra pieces
++#define SM_MAX_PIECES 3
++
++typedef LEUnicode SplitMatra[SM_MAX_PIECES];
+
+ class MPreFixups;
+ class LEGlyphStorage;
diff --git a/Build/source/libs/icu/icu-4.6/layout/IndicReordering.cpp b/Build/source/libs/icu/icu-4.6/layout/IndicReordering.cpp
index 8f247681c74..76f65bf2994 100644
--- a/Build/source/libs/icu/icu-4.6/layout/IndicReordering.cpp
+++ b/Build/source/libs/icu/icu-4.6/layout/IndicReordering.cpp
@@ -235,13 +235,13 @@ public:
for ( i = beginSyllable ; i < nextSyllable ; i++ ) {
if ( classTable->isMatra(fOutChars[i+inv_count])) {
- IndicClassTable::CharClass matraClass = classTable->getCharClass(fOutChars[i+inv_count]);
+ IndicClassTable::CharClass matraClass = classTable->getCharClass(fOutChars[i+inv_count]);
if ( classTable->isSplitMatra(matraClass)) {
le_int32 saveIndex = fGlyphStorage.getCharIndex(i+inv_count,success);
le_uint32 saveAuxData = fGlyphStorage.getAuxData(i+inv_count,success);
const SplitMatra *splitMatra = classTable->getSplitMatra(matraClass);
int j;
- for (j = 0 ; *(splitMatra)[j] != 0 ; j++) {
+ for (j = 0 ; j < SM_MAX_PIECES && *(splitMatra)[j] != 0 ; j++) {
LEUnicode piece = (*splitMatra)[j];
if ( j == 0 ) {
fOutChars[i+inv_count] = piece;
@@ -252,7 +252,7 @@ public:
}
}
}
-
+
if ((matraClass & CF_POS_MASK) == CF_POS_BEFORE) {
moveCharacter(i+inv_count,beginSyllable+inv_count);
}
@@ -332,7 +332,7 @@ public:
const SplitMatra *splitMatra = classTable->getSplitMatra(matraClass);
int i;
- for (i = 0; i < 3 && (*splitMatra)[i] != 0; i += 1) {
+ for (i = 0; i < SM_MAX_PIECES && (*splitMatra)[i] != 0; i += 1) {
LEUnicode piece = (*splitMatra)[i];
IndicClassTable::CharClass pieceClass = classTable->getCharClass(piece);
diff --git a/Build/source/libs/icu/icu-4.6/layout/IndicReordering.h b/Build/source/libs/icu/icu-4.6/layout/IndicReordering.h
index c3452faad93..4a19232d215 100644
--- a/Build/source/libs/icu/icu-4.6/layout/IndicReordering.h
+++ b/Build/source/libs/icu/icu-4.6/layout/IndicReordering.h
@@ -71,7 +71,10 @@ U_NAMESPACE_BEGIN
#define SF_POST_BASE_LIMIT_MASK 0x0000FFFFU
#define SF_NO_POST_BASE_LIMIT 0x00007FFFU
-typedef LEUnicode SplitMatra[3];
+// Max number of split matra pieces
+#define SM_MAX_PIECES 3
+
+typedef LEUnicode SplitMatra[SM_MAX_PIECES];
class MPreFixups;
class LEGlyphStorage;