summaryrefslogtreecommitdiff
path: root/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh')
-rw-r--r--Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh17
1 files changed, 15 insertions, 2 deletions
diff --git a/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh b/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh
index 763ea92f935..ff9c5650f69 100644
--- a/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh
+++ b/Build/source/libs/harfbuzz/harfbuzz-src/src/hb-ot-layout-common-private.hh
@@ -832,7 +832,12 @@ struct CoverageFormat2
c = &c_;
coverage = 0;
i = 0;
- j = c->rangeRecord.len ? c_.rangeRecord[0].start : 0;
+ j = c->rangeRecord.len ? c->rangeRecord[0].start : 0;
+ if (unlikely (c->rangeRecord[0].start > c->rangeRecord[0].end))
+ {
+ /* Broken table. Skip. */
+ i = c->rangeRecord.len;
+ }
}
inline bool more (void) { return i < c->rangeRecord.len; }
inline void next (void)
@@ -842,7 +847,14 @@ struct CoverageFormat2
i++;
if (more ())
{
+ hb_codepoint_t old = j;
j = c->rangeRecord[i].start;
+ if (unlikely (j <= old))
+ {
+ /* Broken table. Skip. Important to avoid DoS. */
+ i = c->rangeRecord.len;
+ return;
+ }
coverage = c->rangeRecord[i].value;
}
return;
@@ -855,7 +867,8 @@ struct CoverageFormat2
private:
const struct CoverageFormat2 *c;
- unsigned int i, j, coverage;
+ unsigned int i, coverage;
+ hb_codepoint_t j;
};
private: