diff options
| author | Jungshik Shin (jungshik at google) <jshin@chromium.org> | 2014-12-30 16:38:27 -0800 |
|---|---|---|
| committer | Jungshik Shin (jungshik at google) <jshin@chromium.org> | 2014-12-31 00:40:30 +0000 |
| commit | d6ce3a7a82e062c3210aa20c036a6e48a3791a3d (patch) | |
| tree | c4178cd5c34016fc583f0c8534b9f0f2ddcbf7c2 /third_party | |
| parent | 4b0a034adda758af0443aaf2fb3972abca2885ba (diff) | |
| download | chromium_src-d6ce3a7a82e062c3210aa20c036a6e48a3791a3d.zip chromium_src-d6ce3a7a82e062c3210aa20c036a6e48a3791a3d.tar.gz chromium_src-d6ce3a7a82e062c3210aa20c036a6e48a3791a3d.tar.bz2 | |
Merge a harfbuzz 2-line patch to M40 branch
BUG=443274
TEST=See the bug
TBR=behdad
Review URL: https://codereview.chromium.org/795393003
Cr-Commit-Position: refs/heads/master@{#308894}
(cherry picked from commit 6c59b0e9e526fb55146c8c458e7ef5d984e2bf7e)
Review URL: https://codereview.chromium.org/814293006
Cr-Commit-Position: refs/branch-heads/2214@{#365}
Cr-Branched-From: 03655fd3f6d72165dc3c9bd2c89807305316fe6c-refs/heads/master@{#303346}
Diffstat (limited to 'third_party')
| -rw-r--r-- | third_party/harfbuzz-ng/README.chromium | 2 | ||||
| -rw-r--r-- | third_party/harfbuzz-ng/gsubgpos.patch | 20 | ||||
| -rw-r--r-- | third_party/harfbuzz-ng/src/hb-ot-layout-gsubgpos-private.hh | 2 |
3 files changed, 24 insertions, 0 deletions
diff --git a/third_party/harfbuzz-ng/README.chromium b/third_party/harfbuzz-ng/README.chromium index 62cbd7a..e2d0b24 100644 --- a/third_party/harfbuzz-ng/README.chromium +++ b/third_party/harfbuzz-ng/README.chromium @@ -19,3 +19,5 @@ BUILD.gn and harfbuzz.gyp accordingly. Right now, it uses revision d457e3f0ff9b27616a34e4cc110d3edbf8796841 from https://github.com/behdad/harfbuzz + +On top of that, gsubgpos.patch (2-liner) was applied. diff --git a/third_party/harfbuzz-ng/gsubgpos.patch b/third_party/harfbuzz-ng/gsubgpos.patch new file mode 100644 index 0000000..47709f1 --- /dev/null +++ b/third_party/harfbuzz-ng/gsubgpos.patch @@ -0,0 +1,20 @@ +diff --git a/src/hb-ot-layout-gsubgpos-private.hh b/src/hb-ot-layout-gsubgpos-private.hh
+index 6ff15d2..dafca7f 100644
+--- a/src/hb-ot-layout-gsubgpos-private.hh
++++ b/src/hb-ot-layout-gsubgpos-private.hh
+@@ -1498,6 +1498,7 @@ struct ContextFormat3
+ TRACE_SANITIZE (this);
+ if (!c->check_struct (this)) return TRACE_RETURN (false);
+ unsigned int count = glyphCount;
++ if (!count) return TRACE_RETURN (false); /* We want to access coverage[0] freely. */
+ if (!c->check_array (coverage, coverage[0].static_size, count)) return TRACE_RETURN (false);
+ for (unsigned int i = 0; i < count; i++)
+ if (!coverage[i].sanitize (c, this)) return TRACE_RETURN (false);
+@@ -2109,6 +2110,7 @@ struct ChainContextFormat3
+ if (!backtrack.sanitize (c, this)) return TRACE_RETURN (false);
+ OffsetArrayOf<Coverage> &input = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
+ if (!input.sanitize (c, this)) return TRACE_RETURN (false);
++ if (!input.len) return TRACE_RETURN (false); /* To be consistent with Context. */
+ OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage> > (input);
+ if (!lookahead.sanitize (c, this)) return TRACE_RETURN (false);
+ ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead);
diff --git a/third_party/harfbuzz-ng/src/hb-ot-layout-gsubgpos-private.hh b/third_party/harfbuzz-ng/src/hb-ot-layout-gsubgpos-private.hh index 546ff4b..fc9eed0 100644 --- a/third_party/harfbuzz-ng/src/hb-ot-layout-gsubgpos-private.hh +++ b/third_party/harfbuzz-ng/src/hb-ot-layout-gsubgpos-private.hh @@ -1479,6 +1479,7 @@ struct ContextFormat3 TRACE_SANITIZE (this); if (!c->check_struct (this)) return TRACE_RETURN (false); unsigned int count = glyphCount; + if (!count) return TRACE_RETURN (false); /* We want to access coverage[0] freely. */ if (!c->check_array (coverage, coverage[0].static_size, count)) return TRACE_RETURN (false); for (unsigned int i = 0; i < count; i++) if (!coverage[i].sanitize (c, this)) return TRACE_RETURN (false); @@ -2090,6 +2091,7 @@ struct ChainContextFormat3 if (!backtrack.sanitize (c, this)) return TRACE_RETURN (false); OffsetArrayOf<Coverage> &input = StructAfter<OffsetArrayOf<Coverage> > (backtrack); if (!input.sanitize (c, this)) return TRACE_RETURN (false); + if (!input.len) return TRACE_RETURN (false); /* To be consistent with Context. */ OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage> > (input); if (!lookahead.sanitize (c, this)) return TRACE_RETURN (false); ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead); |