diff options
| author | Michael Meeks <michael.meeks@collabora.com> | 2024-06-08 14:38:34 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2024-06-10 17:01:53 +0200 |
| commit | e095af113f72e53b984c2862e9ff0e9bf1da3e4a (patch) | |
| tree | e9a268c8ade518d5630305085193ade5b7fa36b5 | |
| parent | 3e88fa3cffe7eb5008f9fe7ff8fc9cbf15ce2b97 (diff) | |
Avoid potential negative array index access to cached text.
if ((nIndex != 0 || nLen != text.getLength()) && !skipGlyphSubsets)
seems unlikely to protect us from this:
/opt/rh/devtoolset-12/root/usr/include/c++/12/string_view:239: constexpr const std::basic_string_view<_CharT, _Traits>::value_type& std::basic_string_view<_CharT, _Traits>::operator[](size_type) const [with _CharT = char16_t; _Traits = std::char_traits<char16_t>; const_reference = const char16_t&; size_type = long unsigned int]: Assertion '__pos < this->_M_len' failed.
coolwsd[16958] ... SIG Fatal signal received: SIGABRT code: 18446744073709551610 for address: 0x7300004e16
SalLayoutGlyphsCache::GetLayoutGlyphs(VclPtr<OutputDevice const>, rtl::OUString const&, int, int, long, vcl::text::TextLayoutCache const*)
/home/collabora/jenkins/workspace/build_core_co-24.04_for_online_snapshot/vcl/source/gdi/impglyphitem.cxx:399
GetTextArray(OutputDevice const&, rtl::OUString const&, KernArray&, int, int, bool, vcl::text::TextLayoutCache const*)
/home/collabora/jenkins/workspace/build_core_co-24.04_for_online_snapshot/include/rtl/ref.hxx:128
SwFntObj::GetTextSize(SwDrawTextInfo&)
/home/collabora/jenkins/workspace/build_core_co-24.04_for_online_snapshot/sw/source/core/txtnode/fntcache.cxx:766
SwSubFont::GetTextSize_(SwDrawTextInfo&)
/home/collabora/jenkins/workspace/build_core_co-24.04_for_online_snapshot/sw/source/core/txtnode/swfont.cxx:1022
SwTextSizeInfo::GetTextSize() const
/home/collabora/jenkins/workspace/build_core_co-24.04_for_online_snapshot/sw/source/core/inc/swfont.hxx:314
blind fix - but seeing a lot of these.
Change-Id: Icb6ca25e4b8c6ef8a5e5b89dfa01b56bb788378d
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168575
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
| -rw-r--r-- | vcl/source/gdi/impglyphitem.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/vcl/source/gdi/impglyphitem.cxx b/vcl/source/gdi/impglyphitem.cxx index ca8016a1925d..e50948077f45 100644 --- a/vcl/source/gdi/impglyphitem.cxx +++ b/vcl/source/gdi/impglyphitem.cxx @@ -379,7 +379,7 @@ SalLayoutGlyphsCache::GetLayoutGlyphs(VclPtr<const OutputDevice> outputDevice, c if (mLastSubstringKey.has_value() && !bAbortOnFontSubstitute) { sal_Int32 pos = nIndex; - if (mLastSubstringKey->len < pos && text[pos - 1] == nbSpace) + if (mLastSubstringKey->len < pos && pos > 0 && text[pos - 1] == nbSpace) --pos; // Writer skips a non-breaking space, so skip that character too. if ((mLastSubstringKey->len == pos || mLastSubstringKey->index == nIndex) && mLastSubstringKey |