Null-terminate output data in to_tis620()

This fixes a crash in thaiWordBreaks() detected a WebKit layout test.
Specifically, editing/selection/thai-word-at-document-end.html

Regressed with cce760d41f115fecd5b9b6b20b62883b10a9c204

Signed-off-by: Simon Hausmann <simon.hausmann@nokia.com>

1 files changed, 5 insertions, 3 deletions

diff --git a/src/harfbuzz-thai.c b/src/harfbuzz-thai.c
index fc2bdbf..e153ba9 100644
--- a/src/harfbuzz-thai.c
+++ b/src/harfbuzz-thai.c
@@ -53,6 +53,8 @@ static void to_tis620(const HB_UChar16 *string, hb_uint32 len, const char *cstr)
         else
             result[i] = '?';
     }
+
+    result[len] = 0;
 }
 
 static void thaiWordBreaks(const HB_UChar16 *string, hb_uint32 len, HB_CharAttributes *attributes)
@@ -70,8 +72,8 @@ static void thaiWordBreaks(const HB_UChar16 *string, hb_uint32 len, HB_CharAttri
     if (!th_brk)
         return;
 
-    if (len > 128)
-        cstr = (char *)malloc(len*sizeof(char));
+    if (len >= 128)
+        cstr = (char *)malloc(len*sizeof(char) + 1);
 
     to_tis620(string, len, cstr);
 
@@ -96,7 +98,7 @@ static void thaiWordBreaks(const HB_UChar16 *string, hb_uint32 len, HB_CharAttri
     if (break_positions != brp)
         free(break_positions);
 
-    if (len > 128)
+    if (len >= 128)
         free(cstr);
 }