Avoid possible array bounds violation

git-svn-id: svn://tug.org/texlive/trunk@21498 c570f23f-e606-0410-a88d-b1316a301751

4 files changed, 68 insertions, 5 deletions

diff --git a/Build/source/libs/icu/icu-4.6-PATCHES/ChangeLog b/Build/source/libs/icu/icu-4.6-PATCHES/ChangeLog
index b90685be95a..f9afa564918 100644
--- a/Build/source/libs/icu/icu-4.6-PATCHES/ChangeLog
+++ b/Build/source/libs/icu/icu-4.6-PATCHES/ChangeLog
@@ -1,3 +1,7 @@
+2011-02-22  Peter Breitenlohner  <peb@mppmu.mpg.de>
+
+	* patch-81-Indic (new): IndicReordering.*: Respect array bounds.
+
 2010-12-07  Peter Breitenlohner  <peb@mppmu.mpg.de>
 
 	* patch-11-CURR_FULL_DIR: Correctly handle CURR_FULL_DIR when
diff --git a/Build/source/libs/icu/icu-4.6-PATCHES/patch-81-Indic b/Build/source/libs/icu/icu-4.6-PATCHES/patch-81-Indic
new file mode 100644
index 00000000000..4e50d93022a
--- /dev/null
+++ b/Build/source/libs/icu/icu-4.6-PATCHES/patch-81-Indic
@@ -0,0 +1,56 @@
+	Make sure the loop over SplitMatra pieces stays within array bounds.
+
+	Remove some trailing white space.
+
+diff -ur icu-4.6.orig/source/layout/IndicReordering.cpp icu-4.6/source/layout/IndicReordering.cpp
+--- icu-4.6.orig/source/layout/IndicReordering.cpp	2009-10-08 21:13:13.000000000 +0200
++++ icu-4.6/source/layout/IndicReordering.cpp	2011-02-22 10:35:06.000000000 +0100
+@@ -235,13 +235,13 @@
+ 
+ 		for ( i = beginSyllable ; i < nextSyllable ; i++ ) {
+ 			if ( classTable->isMatra(fOutChars[i+inv_count])) {
+-				IndicClassTable::CharClass matraClass = classTable->getCharClass(fOutChars[i+inv_count]);	
++				IndicClassTable::CharClass matraClass = classTable->getCharClass(fOutChars[i+inv_count]);
+ 				if ( classTable->isSplitMatra(matraClass)) {
+ 					le_int32 saveIndex = fGlyphStorage.getCharIndex(i+inv_count,success);
+ 					le_uint32 saveAuxData = fGlyphStorage.getAuxData(i+inv_count,success);
+                     const SplitMatra *splitMatra = classTable->getSplitMatra(matraClass);
+                     int j;
+-                    for (j = 0 ; *(splitMatra)[j] != 0 ; j++) {
++                    for (j = 0 ; j < SM_MAX_PIECES && *(splitMatra)[j] != 0 ; j++) {
+                         LEUnicode piece = (*splitMatra)[j];
+ 						if ( j == 0 ) {
+ 							fOutChars[i+inv_count] = piece;
+@@ -252,7 +252,7 @@
+ 						}
+  				    }
+ 				}
+-				
++
+ 				if ((matraClass & CF_POS_MASK) == CF_POS_BEFORE) {
+                     moveCharacter(i+inv_count,beginSyllable+inv_count);
+ 				}
+@@ -332,7 +332,7 @@
+                 const SplitMatra *splitMatra = classTable->getSplitMatra(matraClass);
+                 int i;
+ 
+-                for (i = 0; i < 3 && (*splitMatra)[i] != 0; i += 1) {
++                for (i = 0; i < SM_MAX_PIECES && (*splitMatra)[i] != 0; i += 1) {
+                     LEUnicode piece = (*splitMatra)[i];
+                     IndicClassTable::CharClass pieceClass = classTable->getCharClass(piece);
+ 
+diff -ur icu-4.6.orig/source/layout/IndicReordering.h icu-4.6/source/layout/IndicReordering.h
+--- icu-4.6.orig/source/layout/IndicReordering.h	2009-06-11 20:34:01.000000000 +0200
++++ icu-4.6/source/layout/IndicReordering.h	2011-02-22 10:22:43.000000000 +0100
+@@ -71,7 +71,10 @@
+ #define SF_POST_BASE_LIMIT_MASK  0x0000FFFFU
+ #define SF_NO_POST_BASE_LIMIT    0x00007FFFU
+ 
+-typedef LEUnicode SplitMatra[3];
++// Max number of split matra pieces
++#define SM_MAX_PIECES 3
++
++typedef LEUnicode SplitMatra[SM_MAX_PIECES];
+ 
+ class MPreFixups;
+ class LEGlyphStorage;
diff --git a/Build/source/libs/icu/icu-4.6/layout/IndicReordering.cpp b/Build/source/libs/icu/icu-4.6/layout/IndicReordering.cpp
index 8f247681c74..76f65bf2994 100644
--- a/Build/source/libs/icu/icu-4.6/layout/IndicReordering.cpp
+++ b/Build/source/libs/icu/icu-4.6/layout/IndicReordering.cpp
@@ -235,13 +235,13 @@ public:
 
 		for ( i = beginSyllable ; i < nextSyllable ; i++ ) {
 			if ( classTable->isMatra(fOutChars[i+inv_count])) {
-				IndicClassTable::CharClass matraClass = classTable->getCharClass(fOutChars[i+inv_count]);	
+				IndicClassTable::CharClass matraClass = classTable->getCharClass(fOutChars[i+inv_count]);
 				if ( classTable->isSplitMatra(matraClass)) {
 					le_int32 saveIndex = fGlyphStorage.getCharIndex(i+inv_count,success);
 					le_uint32 saveAuxData = fGlyphStorage.getAuxData(i+inv_count,success);
                     const SplitMatra *splitMatra = classTable->getSplitMatra(matraClass);
                     int j;
-                    for (j = 0 ; *(splitMatra)[j] != 0 ; j++) {
+                    for (j = 0 ; j < SM_MAX_PIECES && *(splitMatra)[j] != 0 ; j++) {
                         LEUnicode piece = (*splitMatra)[j];
 						if ( j == 0 ) {
 							fOutChars[i+inv_count] = piece;
@@ -252,7 +252,7 @@ public:
 						}
  				    }
 				}
-				
+
 				if ((matraClass & CF_POS_MASK) == CF_POS_BEFORE) {
                     moveCharacter(i+inv_count,beginSyllable+inv_count);
 				}
@@ -332,7 +332,7 @@ public:
                 const SplitMatra *splitMatra = classTable->getSplitMatra(matraClass);
                 int i;
 
-                for (i = 0; i < 3 && (*splitMatra)[i] != 0; i += 1) {
+                for (i = 0; i < SM_MAX_PIECES && (*splitMatra)[i] != 0; i += 1) {
                     LEUnicode piece = (*splitMatra)[i];
                     IndicClassTable::CharClass pieceClass = classTable->getCharClass(piece);
 
diff --git a/Build/source/libs/icu/icu-4.6/layout/IndicReordering.h b/Build/source/libs/icu/icu-4.6/layout/IndicReordering.h
index c3452faad93..4a19232d215 100644
--- a/Build/source/libs/icu/icu-4.6/layout/IndicReordering.h
+++ b/Build/source/libs/icu/icu-4.6/layout/IndicReordering.h
@@ -71,7 +71,10 @@ U_NAMESPACE_BEGIN
 #define SF_POST_BASE_LIMIT_MASK  0x0000FFFFU
 #define SF_NO_POST_BASE_LIMIT    0x00007FFFU
 
-typedef LEUnicode SplitMatra[3];
+// Max number of split matra pieces
+#define SM_MAX_PIECES 3
+
+typedef LEUnicode SplitMatra[SM_MAX_PIECES];
 
 class MPreFixups;
 class LEGlyphStorage;