walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[opentype] Protect against illegal access for arrays of length zero

This commit is contained in:
Behdad Esfahbod 2009-03-02 15:16:11 +03:30
parent 66871797af
commit d49caf1f77
2 changed files with 24 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/harfbuzz-gpos.c
View File

@ -2080,9 +2080,13 @@ static void Free_BaseArray( HB_BaseArray* ba,
if ( ba->BaseRecord ) if ( ba->BaseRecord )
{ {
br = ba->BaseRecord; br = ba->BaseRecord;
bans = br[0].BaseAnchor;
FREE( bans ); if ( ba->BaseCount )
{
bans = br[0].BaseAnchor;
FREE( bans );
}
FREE( br ); FREE( br );
} }
} }
@ -2811,9 +2815,13 @@ static void Free_Mark2Array( HB_Mark2Array* m2a,
if ( m2a->Mark2Record ) if ( m2a->Mark2Record )
{ {
m2r = m2a->Mark2Record; m2r = m2a->Mark2Record;
m2ans = m2r[0].Mark2Anchor;
FREE( m2ans ); if ( m2a->Mark2Count )
{
m2ans = m2r[0].Mark2Anchor;
FREE( m2ans );
}
FREE( m2r ); FREE( m2r );
} }
} }
@ -3857,6 +3865,9 @@ static HB_Error Lookup_ContextPos2( GPOS_Instance* gpi,
if ( error ) if ( error )
return error; return error;
if (cpf2->MaxContextLength < 1)
return HB_Err_Not_Covered;
if ( ALLOC_ARRAY( classes, cpf2->MaxContextLength, HB_UShort ) ) if ( ALLOC_ARRAY( classes, cpf2->MaxContextLength, HB_UShort ) )
return error; return error;
@ -5139,6 +5150,9 @@ static HB_Error Lookup_ChainContextPos2(
return error; return error;
known_backtrack_classes = 0; known_backtrack_classes = 0;
if (ccpf2->MaxInputLength < 1)
return HB_Err_Not_Covered;
if ( ALLOC_ARRAY( input_classes, ccpf2->MaxInputLength, HB_UShort ) ) if ( ALLOC_ARRAY( input_classes, ccpf2->MaxInputLength, HB_UShort ) )
goto End3; goto End3;
known_input_classes = 1; known_input_classes = 1;

6
src/harfbuzz-gsub.c
View File

@ -1896,6 +1896,9 @@ static HB_Error Lookup_ContextSubst2( HB_GSUBHeader* gsub,
if ( error ) if ( error )
return error; return error;
if (csf2->MaxContextLength < 1)
return HB_Err_Not_Covered;
if ( ALLOC_ARRAY( classes, csf2->MaxContextLength, HB_UShort ) ) if ( ALLOC_ARRAY( classes, csf2->MaxContextLength, HB_UShort ) )
return error; return error;
@ -3159,6 +3162,9 @@ static HB_Error Lookup_ChainContextSubst2( HB_GSUBHeader* gsub,
return error; return error;
known_backtrack_classes = 0; known_backtrack_classes = 0;
if (ccsf2->MaxInputLength < 1)
return HB_Err_Not_Covered;
if ( ALLOC_ARRAY( input_classes, ccsf2->MaxInputLength, HB_UShort ) ) if ( ALLOC_ARRAY( input_classes, ccsf2->MaxInputLength, HB_UShort ) )
goto End3; goto End3;
known_input_classes = 1; known_input_classes = 1;