From bb35725cd760f07fdb0586453512a106e534b739 Mon Sep 17 00:00:00 2001 From: Behdad Esfahbod Date: Mon, 15 Oct 2018 10:20:39 -0700 Subject: [PATCH] [kerx/morx] More end-of-text protection --- src/hb-aat-layout-kerx-table.hh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/hb-aat-layout-kerx-table.hh b/src/hb-aat-layout-kerx-table.hh index ae11963a9..aa8039771 100644 --- a/src/hb-aat-layout-kerx-table.hh +++ b/src/hb-aat-layout-kerx-table.hh @@ -172,7 +172,7 @@ struct KerxSubTableFormat1 * list. Discovered by testing. */ unsigned int idx = stack[i]; int v = *actions++; - if (buffer->info[idx].mask & kern_mask) + if (idx < buffer->len && buffer->info[idx].mask & kern_mask) { /* XXX Non-forward direction... */ if (HB_DIRECTION_IS_HORIZONTAL (buffer->props.direction)) @@ -340,7 +340,7 @@ struct KerxSubTableFormat4 hb_buffer_t *buffer = driver->buffer; unsigned int flags = entry->flags; - if (mark_set && entry->data.ankrActionIndex != 0xFFFF) + if (mark_set && entry->data.ankrActionIndex != 0xFFFF && buffer->idx < buffer->len) { hb_glyph_position_t &o = buffer->cur_pos(); switch (action_type)