Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f095a382daee0c095c6b0454507ca46a8420b52c
https://github.com/WebKit/WebKit/commit/f095a382daee0c095c6b0454507ca46a8420b52c
Author: Han Zheng <[email protected]>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp
Log Message:
-----------
Validate the full FeatureList array once in OpenTypeVerticalData findFeature
https://bugs.webkit.org/show_bug.cgi?id=322969
Reviewed by Carlos Garcia Campos and Adrian Perez de Castro.
FeatureList::findFeature validated only the start of each FeatureRecord
before reading its fields, which extend to the start of the following
record. Bound the whole array up front by checking the one-past-the-end
record, matching the idiom already used by FeatureList::feature,
FeatureTable::getGlyphSubstitutions, LangSysTable::feature and
ScriptList::script, then iterate. This also hoists the check out of the
loop.
* Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp:
(WebCore::OpenType::FeatureList::findFeature const):
Canonical link: https://commits.webkit.org/320142@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
