diff options
Diffstat (limited to 'Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh')
-rw-r--r-- | Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh b/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh index 763ea92f935..ff9c5650f69 100644 --- a/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh +++ b/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh @@ -832,7 +832,12 @@ struct CoverageFormat2 c = &c_; coverage = 0; i = 0; - j = c->rangeRecord.len ? c_.rangeRecord[0].start : 0; + j = c->rangeRecord.len ? c->rangeRecord[0].start : 0; + if (unlikely (c->rangeRecord[0].start > c->rangeRecord[0].end)) + { + /* Broken table. Skip. */ + i = c->rangeRecord.len; + } } inline bool more (void) { return i < c->rangeRecord.len; } inline void next (void) @@ -842,7 +847,14 @@ struct CoverageFormat2 i++; if (more ()) { + hb_codepoint_t old = j; j = c->rangeRecord[i].start; + if (unlikely (j <= old)) + { + /* Broken table. Skip. Important to avoid DoS. */ + i = c->rangeRecord.len; + return; + } coverage = c->rangeRecord[i].value; } return; @@ -855,7 +867,8 @@ struct CoverageFormat2 private: const struct CoverageFormat2 *c; - unsigned int i, j, coverage; + unsigned int i, coverage; + hb_codepoint_t j; }; private: |