From 258305c2a5dd47bd2d83f12eaf9caa5b19ae5efb Mon Sep 17 00:00:00 2001 From: Behdad Esfahbod Date: Fri, 13 Aug 2010 14:10:02 -0400 Subject: [PATCH] [GPOS] Fix div-by-zero Patch by Jonathan Kew. Mozilla bug #465728. --- src/hb-ot-layout-gpos-private.hh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/hb-ot-layout-gpos-private.hh b/src/hb-ot-layout-gpos-private.hh index 3b40bdc6b..a5f65b482 100644 --- a/src/hb-ot-layout-gpos-private.hh +++ b/src/hb-ot-layout-gpos-private.hh @@ -345,7 +345,7 @@ struct AnchorMatrix inline bool sanitize (hb_sanitize_context_t *c, unsigned int cols) { TRACE_SANITIZE (); if (!c->check_struct (this)) return false; - if (unlikely (cols >= ((unsigned int) -1) / rows)) return false; + if (unlikely (rows > 0 && cols >= ((unsigned int) -1) / rows)) return false; unsigned int count = rows * cols; if (!c->check_array (matrix, matrix[0].static_size, count)) return false; for (unsigned int i = 0; i < count; i++)