diff options
| author | Behdad Esfahbod <behdad@behdad.org> | 2018-10-15 10:20:39 -0700 |
|---|---|---|
| committer | Behdad Esfahbod <behdad@behdad.org> | 2018-10-15 11:05:10 -0700 |
| commit | bb35725cd760f07fdb0586453512a106e534b739 (patch) | |
| tree | d0981ba252e6570efad0a588a876f57a380c2c3e | |
| parent | 8f3048a1f838484babc4948754c16dda8f53daf1 (diff) | |
[kerx/morx] More end-of-text protection
| -rw-r--r-- | src/hb-aat-layout-kerx-table.hh | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/hb-aat-layout-kerx-table.hh b/src/hb-aat-layout-kerx-table.hh index ae11963a..aa803977 100644 --- a/src/hb-aat-layout-kerx-table.hh +++ b/src/hb-aat-layout-kerx-table.hh @@ -172,7 +172,7 @@ struct KerxSubTableFormat1 * list. Discovered by testing. */ unsigned int idx = stack[i]; int v = *actions++; - if (buffer->info[idx].mask & kern_mask) + if (idx < buffer->len && buffer->info[idx].mask & kern_mask) { /* XXX Non-forward direction... */ if (HB_DIRECTION_IS_HORIZONTAL (buffer->props.direction)) @@ -340,7 +340,7 @@ struct KerxSubTableFormat4 hb_buffer_t *buffer = driver->buffer; unsigned int flags = entry->flags; - if (mark_set && entry->data.ankrActionIndex != 0xFFFF) + if (mark_set && entry->data.ankrActionIndex != 0xFFFF && buffer->idx < buffer->len) { hb_glyph_position_t &o = buffer->cur_pos(); switch (action_type) |