Re: [PATCH] array overrun in pango graphics

Thanks Hub, I will take a look.

Tomas

Hubert Figuiere wrote:
> Hi,
>
> Attached is a patch to fix an array overrun in the pango graphics. Since
> I don't really understand all the details of this code, I don't really
> want to commit it.
>
> RI.m_pGlyphs->glyphs[i].geometry.width += RI.m_pJustify[i];
>
> But basically there are case where RI.m_iLength (the max value of i) is
> longer than RI.m_pGlyphs->num_glyphs (the length of m_pJustify[]),
> causing an overrun.
>
> Any comment?
>
> Hub
>
>
> ------------------------------------------------------------------------
>
> Index: src/af/gr/unix/gr_UnixPangoGraphics.cpp
> ===================================================================
> --- src/af/gr/unix/gr_UnixPangoGraphics.cpp (revision 21883)
> +++ src/af/gr/unix/gr_UnixPangoGraphics.cpp (working copy)
> @@ -1800,11 +1800,13 @@
> iExtraSpace -= iSpace;
> iPoints--;
>
> - RI.m_pJustify[i] = ltpu(iSpace);
> -
> - // TODO here we need to add this amount the pango metrics
> - RI.m_pGlyphs->glyphs[i].geometry.width += RI.m_pJustify[i];
> -
> + if(i < RI.m_pGlyphs->num_glyphs)
> + {
> + RI.m_pJustify[i] = ltpu(iSpace);
> +
> + // TODO here we need to add this amount the pango metrics
> + RI.m_pGlyphs->glyphs[i].geometry.width += RI.m_pJustify[i];
> + }
> if(!iPoints)
> break;
> }
Received on Mon Sep 3 08:39:53 2007