[avar] Fix out-of-bound read when input is bigger than all the coords

'i' shouldn't become equal to array's length which as the increament
is happened at end of the loop, if the input is bigger than all the
table coords, it will be equal to array's length.

Fixes https://crbug.com/oss-fuzz/21092
This commit is contained in:
Ebrahim Byagowi 2020-03-07 11:53:12 +03:30
parent 6924e29f62
commit 0d729b4b72
2 changed files with 1 additions and 1 deletions

View File

@ -79,7 +79,7 @@ struct SegmentMaps : ArrayOf<AxisValueMap>
return value - arrayZ[0].fromCoord + arrayZ[0].toCoord;
unsigned int i;
unsigned int count = len;
unsigned int count = len - 1;
for (i = 1; i < count && value > arrayZ[i].fromCoord; i++)
;