summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBehdad Esfahbod <behdad@behdad.org>2018-10-15 10:20:39 -0700
committerBehdad Esfahbod <behdad@behdad.org>2018-10-15 11:05:10 -0700
commitbb35725cd760f07fdb0586453512a106e534b739 (patch)
treed0981ba252e6570efad0a588a876f57a380c2c3e
parent8f3048a1f838484babc4948754c16dda8f53daf1 (diff)
[kerx/morx] More end-of-text protection
-rw-r--r--src/hb-aat-layout-kerx-table.hh4
1 files changed, 2 insertions, 2 deletions
diff --git a/src/hb-aat-layout-kerx-table.hh b/src/hb-aat-layout-kerx-table.hh
index ae11963a..aa803977 100644
--- a/src/hb-aat-layout-kerx-table.hh
+++ b/src/hb-aat-layout-kerx-table.hh
@@ -172,7 +172,7 @@ struct KerxSubTableFormat1
* list. Discovered by testing. */
unsigned int idx = stack[i];
int v = *actions++;
- if (buffer->info[idx].mask & kern_mask)
+ if (idx < buffer->len && buffer->info[idx].mask & kern_mask)
{
/* XXX Non-forward direction... */
if (HB_DIRECTION_IS_HORIZONTAL (buffer->props.direction))
@@ -340,7 +340,7 @@ struct KerxSubTableFormat4
hb_buffer_t *buffer = driver->buffer;
unsigned int flags = entry->flags;
- if (mark_set && entry->data.ankrActionIndex != 0xFFFF)
+ if (mark_set && entry->data.ankrActionIndex != 0xFFFF && buffer->idx < buffer->len)
{
hb_glyph_position_t &o = buffer->cur_pos();
switch (action_type)