From 0532ed160c678b5404b20594fd2ca9a640bf6a0a Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Wed, 12 Aug 2009 15:40:04 -0400
Subject: [PATCH] [HB] Fix invalid access / overflow on x86-64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bug 591557 – [HB] crash scrolling the evolution message list
Bug 591576 – crashed with SIGSEGV at pango
---
 src/hb-ot-layout-gpos-private.hh | 21 ++++++++++++---------
 src/hb-ot-layout-gsub-private.hh |  2 --
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/src/hb-ot-layout-gpos-private.hh b/src/hb-ot-layout-gpos-private.hh
index 307f2699b..c7ac4f079 100644
--- a/src/hb-ot-layout-gpos-private.hh
+++ b/src/hb-ot-layout-gpos-private.hh
@@ -913,13 +913,14 @@ struct MarkBasePosFormat1
 
     /* now we search backwards for a non-mark glyph */
     unsigned int count = buffer->in_pos;
-    unsigned int i = 1, j = count - 1;
-    while (_hb_ot_layout_skip_mark (context->face, IN_INFO (j), LookupFlag::IgnoreMarks, &property))
+    unsigned int i = 0, j = count;
+    do
     {
       if (HB_UNLIKELY (i == count))
 	return false;
       i++, j--;
-    }
+    } while (_hb_ot_layout_skip_mark (context->face, IN_INFO (j), LookupFlag::IgnoreMarks, &property))
+
 #if 0
     /* The following assertion is too strong. */
     if (!(property & HB_OT_LAYOUT_GLYPH_CLASS_BASE_GLYPH))
@@ -1046,13 +1047,14 @@ struct MarkLigPosFormat1
 
     /* now we search backwards for a non-mark glyph */
     unsigned int count = buffer->in_pos;
-    unsigned int i = 1, j = count - 1;
-    while (_hb_ot_layout_skip_mark (context->face, IN_INFO (j), LookupFlag::IgnoreMarks, &property))
+    unsigned int i = 0, j = count;
+    do
     {
       if (HB_UNLIKELY (i == count))
 	return false;
       i++, j--;
-    }
+    } while (_hb_ot_layout_skip_mark (context->face, IN_INFO (j), LookupFlag::IgnoreMarks, &property));
+
 #if 0
     /* The following assertion is too strong. */
     if (!(property & HB_OT_LAYOUT_GLYPH_CLASS_LIGATURE))
@@ -1203,13 +1205,14 @@ struct MarkMarkPosFormat1
 
     /* now we search backwards for a suitable mark glyph until a non-mark glyph */
     unsigned int count = buffer->in_pos;
-    unsigned int i = 1, j = count - 1;
-    while (_hb_ot_layout_skip_mark (context->face, IN_INFO (j), lookup_flag, &property))
+    unsigned int i = 0, j = count;
+    do
     {
       if (HB_UNLIKELY (i == count))
 	return false;
       i++, j--;
-    }
+    } while (_hb_ot_layout_skip_mark (context->face, IN_INFO (j), lookup_flag, &property));
+
     if (!(property & HB_OT_LAYOUT_GLYPH_CLASS_MARK))
       return false;
 
diff --git a/src/hb-ot-layout-gsub-private.hh b/src/hb-ot-layout-gsub-private.hh
index 50b62861f..af278295f 100644
--- a/src/hb-ot-layout-gsub-private.hh
+++ b/src/hb-ot-layout-gsub-private.hh
@@ -798,11 +798,9 @@ struct SubstLookup : Lookup
 	}
 	if (ret)
 	  _hb_buffer_swap (buffer);
-
     }
     else
     {
-
 	/* in-place backward substitution */
 	buffer->in_pos = buffer->in_length - 1;
 	do