src/hb-aat-layout-morx-table.hh | 2 ++
1 file changed, 2 insertions(+)
New commits:
commit 0f85edb7781f4d5ec2de676979be75a0f6559d80
Author: Behdad Esfahbod <beh...@behdad.org>
Date: Mon Oct 15 11:15:54 2018 -0700
[morx] Another end-of-text corner case
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10990
diff --git a/src/hb-aat-layout-morx-table.hh b/src/hb-aat-layout-morx-table.hh
index 8446a862..c88e7a72 100644
--- a/src/hb-aat-layout-morx-table.hh
+++ b/src/hb-aat-layout-morx-table.hh
@@ -412,6 +412,8 @@ struct LigatureSubtable
if (uoffset & 0x20000000)
uoffset += 0xC0000000;
int32_t offset = (int32_t) uoffset;
+ if (buffer->idx >= buffer->len)
+ return false; // TODO Work on previous instead?
unsigned int component_idx = buffer->cur().codepoint + offset;
const HBUINT16 &componentData = component[component_idx];
_______________________________________________
HarfBuzz mailing list
HarfBuzz@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/harfbuzz
