From 6cf2a52593cb4b23e3efe5e16228e3172bdcdd05 Mon Sep 17 00:00:00 2001 From: Behdad Esfahbod Date: Sun, 17 May 2009 21:11:49 -0400 Subject: [PATCH] [HB] Add check to avoid infinite recursion --- src/hb-ot-layout-gsub-private.h | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/hb-ot-layout-gsub-private.h b/src/hb-ot-layout-gsub-private.h index f5a8ec5ae..c5834b0f5 100644 --- a/src/hb-ot-layout-gsub-private.h +++ b/src/hb-ot-layout-gsub-private.h @@ -646,7 +646,7 @@ struct SubstLookup : Lookup { if (HB_UNLIKELY (type == GSUB_Extension)) { /* Return lookup type of first extension subtable. * The spec says all of them should have the same type. - * XXX check for that somehow */ + * XXX check for that in sanitize() */ type = get_subtable(0).u.extension->get_type (); } @@ -763,10 +763,14 @@ ASSERT_SIZE (GSUB, 10); /* Out-of-class implementation for methods recursing */ inline bool ExtensionSubstFormat1::substitute (LOOKUP_ARGS_DEF) const { - /* XXX either check in sanitize or here that the lookuptype is not 7 again, - * or we can loop indefinitely. */ + unsigned int lookup_type = get_type (); + + /* TODO: belongs to sanitize() */ + if (HB_UNLIKELY (lookup_type == GSUB_ReverseChainSingle)) + return false; + return (*(SubstLookupSubTable *)(((char *) this) + get_offset ())).substitute (LOOKUP_ARGS, - get_type ()); + lookup_type); } static inline bool substitute_lookup (LOOKUP_ARGS_DEF, unsigned int lookup_index) {