walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Tighten Coverage iteration

This commit is contained in:
Behdad Esfahbod 2019-01-08 23:28:05 -08:00
parent ff3a7ce1e7
commit 6caf76f4a8
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/hb-ot-layout-common.hh
View File

@ -1002,9 +1002,12 @@ struct CoverageFormat2
unsigned int old = coverage;
j = c->rangeRecord[i].start;
coverage = c->rangeRecord[i].value;
if (unlikely (coverage <= old))
if (unlikely (coverage != old + 1))
{
/* Broken table. Skip. Important to avoid DoS. */
/* Broken table. Skip. Important to avoid DoS.
* Also, our callers depend on coverage being
* consecutive and monotonically increasing,
* ie. iota(). */
i = c->rangeRecord.len;
return;
}