Skip lookups with lookup index out of range. (Patch from Behdad Esfahbod,

2005-07-26    Owen Taylor  <otaylor@redhat.com>

        * pango/opentype/ftxgsub.c, pango/opentype/ftxgpos.c: Skip lookups
        with lookup index out of range. (Patch from Behdad Esfahbod, #171170)
This commit is contained in:
Owen Taylor 2005-07-26 18:33:27 +00:00 committed by Owen Taylor
parent 91a3fa2e4b
commit 3c60250875
2 changed files with 48 additions and 12 deletions

View File

@ -5872,8 +5872,8 @@
FT_UShort context_length, FT_UShort context_length,
int nesting_level ) int nesting_level )
{ {
FT_Error error = TT_Err_Ok; FT_Error error = TTO_Err_Not_Covered;
FT_UShort i, flags; FT_UShort i, flags, lookup_count;
TTO_GPOSHeader* gpos = gpi->gpos; TTO_GPOSHeader* gpos = gpi->gpos;
TTO_Lookup* lo; TTO_Lookup* lo;
@ -5883,6 +5883,10 @@
if ( nesting_level > TTO_MAX_NESTING_LEVEL ) if ( nesting_level > TTO_MAX_NESTING_LEVEL )
return TTO_Err_Too_Many_Nested_Contexts; return TTO_Err_Too_Many_Nested_Contexts;
lookup_count = gpos->LookupList.LookupCount;
if (lookup_index >= lookup_count)
return error;
lo = &gpos->LookupList.Lookup[lookup_index]; lo = &gpos->LookupList.Lookup[lookup_index];
flags = lo->LookupFlag; flags = lo->LookupFlag;
@ -6049,8 +6053,9 @@
TTO_Feature feature; TTO_Feature feature;
FT_UInt* properties; FT_UInt* properties;
FT_UShort* index; FT_UShort* index;
FT_UShort lookup_count;
/* Each feature can only be added once once */ /* Each feature can only be added once */
if ( !gpos || if ( !gpos ||
feature_index >= gpos->FeatureList.FeatureCount || feature_index >= gpos->FeatureList.FeatureCount ||
@ -6063,9 +6068,14 @@
feature = gpos->FeatureList.FeatureRecord[feature_index].Feature; feature = gpos->FeatureList.FeatureRecord[feature_index].Feature;
index = feature.LookupListIndex; index = feature.LookupListIndex;
lookup_count = gpos->LookupList.LookupCount;
for ( i = 0; i < feature.LookupListCount; i++ ) for ( i = 0; i < feature.LookupListCount; i++ )
properties[index[i]] |= property; {
FT_UShort lookup_index = index[i];
if (lookup_index < lookup_count)
properties[lookup_index] |= property;
}
return TT_Err_Ok; return TT_Err_Ok;
} }
@ -6133,7 +6143,7 @@
{ {
FT_Error error, retError = TTO_Err_Not_Covered; FT_Error error, retError = TTO_Err_Not_Covered;
GPOS_Instance gpi; GPOS_Instance gpi;
FT_UShort i, j, feature_index; FT_UShort i, j, feature_index, lookup_count;
TTO_Feature feature; TTO_Feature feature;
if ( !face || !gpos || if ( !face || !gpos ||
@ -6146,6 +6156,8 @@
gpi.r2l = r2l; gpi.r2l = r2l;
gpi.dvi = dvi; gpi.dvi = dvi;
lookup_count = gpos->LookupList.LookupCount;
for ( i = 0; i < gpos->FeatureList.ApplyCount; i++ ) for ( i = 0; i < gpos->FeatureList.ApplyCount; i++ )
{ {
/* index of i'th feature */ /* index of i'th feature */
@ -6154,7 +6166,13 @@
for ( j = 0; j < feature.LookupListCount; j++ ) for ( j = 0; j < feature.LookupListCount; j++ )
{ {
error = Do_String_Lookup( &gpi, feature.LookupListIndex[j], buffer ); FT_UShort lookup_index = feature.LookupListIndex[j];
/* Skip nonexistant lookups */
if (lookup_index >= lookup_count)
continue;
error = Do_String_Lookup( &gpi, lookup_index, buffer );
if ( error ) if ( error )
{ {
if ( error != TTO_Err_Not_Covered ) if ( error != TTO_Err_Not_Covered )

View File

@ -3939,8 +3939,8 @@
FT_UShort context_length, FT_UShort context_length,
int nesting_level ) int nesting_level )
{ {
FT_Error error = TT_Err_Ok; FT_Error error = TTO_Err_Not_Covered;
FT_UShort i, flags; FT_UShort i, flags, lookup_count;
TTO_Lookup* lo; TTO_Lookup* lo;
@ -3949,6 +3949,10 @@
if ( nesting_level > TTO_MAX_NESTING_LEVEL ) if ( nesting_level > TTO_MAX_NESTING_LEVEL )
return TTO_Err_Too_Many_Nested_Contexts; return TTO_Err_Too_Many_Nested_Contexts;
lookup_count = gsub->LookupList.LookupCount;
if (lookup_index >= lookup_count)
return error;
lo = &gsub->LookupList.Lookup[lookup_index]; lo = &gsub->LookupList.Lookup[lookup_index];
flags = lo->LookupFlag; flags = lo->LookupFlag;
@ -4056,8 +4060,9 @@
TTO_Feature feature; TTO_Feature feature;
FT_UInt* properties; FT_UInt* properties;
FT_UShort* index; FT_UShort* index;
FT_UShort lookup_count;
/* Each feature can only be added once once */ /* Each feature can only be added once */
if ( !gsub || if ( !gsub ||
feature_index >= gsub->FeatureList.FeatureCount || feature_index >= gsub->FeatureList.FeatureCount ||
@ -4070,9 +4075,14 @@
feature = gsub->FeatureList.FeatureRecord[feature_index].Feature; feature = gsub->FeatureList.FeatureRecord[feature_index].Feature;
index = feature.LookupListIndex; index = feature.LookupListIndex;
lookup_count = gsub->LookupList.LookupCount;
for ( i = 0; i < feature.LookupListCount; i++ ) for ( i = 0; i < feature.LookupListCount; i++ )
properties[index[i]] |= property; {
FT_UShort lookup_index = index[i];
if (lookup_index < lookup_count)
properties[lookup_index] |= property;
}
return TT_Err_Ok; return TT_Err_Ok;
} }
@ -4120,13 +4130,15 @@
OTL_Buffer buffer ) OTL_Buffer buffer )
{ {
FT_Error error, retError = TTO_Err_Not_Covered; FT_Error error, retError = TTO_Err_Not_Covered;
FT_UShort i, j, feature_index; FT_UShort i, j, feature_index, lookup_count;
TTO_Feature feature; TTO_Feature feature;
if ( !gsub || if ( !gsub ||
!buffer || buffer->in_length == 0 || buffer->in_pos >= buffer->in_length ) !buffer || buffer->in_length == 0 || buffer->in_pos >= buffer->in_length )
return TT_Err_Invalid_Argument; return TT_Err_Invalid_Argument;
lookup_count = gsub->LookupList.LookupCount;
for ( i = 0; i < gsub->FeatureList.ApplyCount; i++) for ( i = 0; i < gsub->FeatureList.ApplyCount; i++)
{ {
feature_index = gsub->FeatureList.ApplyOrder[i]; feature_index = gsub->FeatureList.ApplyOrder[i];
@ -4134,7 +4146,13 @@
for ( j = 0; j < feature.LookupListCount; j++ ) for ( j = 0; j < feature.LookupListCount; j++ )
{ {
error = Do_String_Lookup( gsub, feature.LookupListIndex[j], buffer ); FT_UShort lookup_index = feature.LookupListIndex[j];
/* Skip nonexistant lookups */
if (lookup_index >= lookup_count)
continue;
error = Do_String_Lookup( gsub, lookup_index, buffer );
if ( error ) if ( error )
{ {
if ( error != TTO_Err_Not_Covered ) if ( error != TTO_Err_Not_Covered )