ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

usp10: Range check glyph counts in GSUB_apply_ChainContextSubst(). 

Like in GPOS_apply_ChainContextPos().

Signed-off-by: Henri Verbeet <hverbeet@codeweavers.com>
Signed-off-by: Aric Stewart <aric@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Henri Verbeet 2017-04-06 12:03:44 +02:00 committed by Alexandre Julliard
parent 24943fe5e2
commit f7b943edbc
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
dlls/usp10/opentype.c
View File

@ -1291,10 +1291,22 @@ static INT GSUB_apply_ChainContextSubst(const OT_LookupList* lookup, const OT_Lo
offset = GET_BE_WORD(csc->ChainSubClassRule[i]);
backtrack = (const GSUB_ChainSubClassRule_1 *)((BYTE *)csc + offset);
backtrack_count = GET_BE_WORD(backtrack->BacktrackGlyphCount);
k = glyph_index + dirBacktrack * backtrack_count;
if (k < 0 || k >= *glyph_count)
continue;
input = (const GSUB_ChainSubClassRule_2 *)&backtrack->Backtrack[backtrack_count];
input_count = GET_BE_WORD(input->InputGlyphCount) - 1;
k = glyph_index + write_dir * input_count;
if (k < 0 || k >= *glyph_count)
continue;
lookahead = (const GSUB_ChainSubClassRule_3 *)&input->Input[input_count];
lookahead_count = GET_BE_WORD(lookahead->LookaheadGlyphCount);
k = glyph_index + dirLookahead * (input_count + lookahead_count);
if (k < 0 || k >= *glyph_count)
continue;
substitute = (const GSUB_ChainSubClassRule_4 *)&lookahead->LookAhead[lookahead_count];
for (k = 0; k < backtrack_count; ++k)
@ -1365,10 +1377,22 @@ static INT GSUB_apply_ChainContextSubst(const OT_LookupList* lookup, const OT_Lo
backtrack = (const GSUB_ChainContextSubstFormat3_1 *)ccsf1;
backtrack_count = GET_BE_WORD(backtrack->BacktrackGlyphCount);
k = glyph_index + dirBacktrack * backtrack_count;
if (k < 0 || k >= *glyph_count)
continue;
input = (const GSUB_ChainContextSubstFormat3_2 *)&backtrack->Coverage[backtrack_count];
input_count = GET_BE_WORD(input->InputGlyphCount);
k = glyph_index + write_dir * (input_count - 1);
if (k < 0 || k >= *glyph_count)
continue;
lookahead = (const GSUB_ChainContextSubstFormat3_3 *)&input->Coverage[input_count];
lookahead_count = GET_BE_WORD(lookahead->LookaheadGlyphCount);
k = glyph_index + dirLookahead * (input_count + lookahead_count - 1);
if (k < 0 || k >= *glyph_count)
continue;
substitute = (const GSUB_ChainContextSubstFormat3_4 *)&lookahead->Coverage[lookahead_count];
for (k = 0; k < backtrack_count; ++k)