[OTLayout] Protect against out-of-range lookup indices

Filter them out when compiling map.
This commit is contained in:
Behdad Esfahbod 2013-10-03 14:54:50 -04:00
parent 6b4fdded94
commit 27674b4bb3
3 changed files with 29 additions and 1 deletions

View File

@ -414,6 +414,23 @@ hb_ot_layout_feature_get_lookups (hb_face_t *face,
return f.get_lookup_indexes (start_offset, lookup_count, lookup_indexes);
}
unsigned int
hb_ot_layout_table_get_lookup_count (hb_face_t *face,
hb_tag_t table_tag)
{
switch (table_tag)
{
case HB_OT_TAG_GSUB:
{
return hb_ot_layout_from_face (face)->gsub_lookup_count;
}
case HB_OT_TAG_GPOS:
{
return hb_ot_layout_from_face (face)->gpos_lookup_count;
}
}
}
static void
_hb_ot_layout_collect_lookups_lookups (hb_face_t *face,
hb_tag_t table_tag,

View File

@ -180,6 +180,11 @@ hb_ot_layout_feature_get_lookups (hb_face_t *face,
unsigned int *lookup_count /* IN/OUT */,
unsigned int *lookup_indexes /* OUT */);
unsigned int
hb_ot_layout_table_get_lookup_count (hb_face_t *face,
hb_tag_t table_tag);
void
hb_ot_layout_collect_lookups (hb_face_t *face,
hb_tag_t table_tag,

View File

@ -40,6 +40,9 @@ hb_ot_map_t::add_lookups (hb_face_t *face,
{
unsigned int lookup_indices[32];
unsigned int offset, len;
unsigned int table_lookup_count;
table_lookup_count = hb_ot_layout_table_get_lookup_count (face, table_tags[table_index]);
offset = 0;
do {
@ -50,7 +53,10 @@ hb_ot_map_t::add_lookups (hb_face_t *face,
offset, &len,
lookup_indices);
for (unsigned int i = 0; i < len; i++) {
for (unsigned int i = 0; i < len; i++)
{
if (lookup_indices[i] >= table_lookup_count)
continue;
hb_ot_map_t::lookup_map_t *lookup = lookups[table_index].push ();
if (unlikely (!lookup))
return;