diff options
| author | Michael Stahl <mstahl@redhat.com> | 2015-05-22 20:53:05 +0200 |
|---|---|---|
| committer | Michael Stahl <mstahl@redhat.com> | 2015-05-22 20:58:43 +0200 |
| commit | 9db629b8a1fa9b63bc320f8d47594ec82511a9c5 (patch) | |
| tree | cb9b321857ba28b4ae0b9cd141e22bb5adca3a50 /i18npool | |
| parent | b2cf675b827912feb5edfbca1ea902d1ab92ed6b (diff) | |
tdf#90809: i18npool: fix crash in Thai break iterator
endPos = nStartPos + 1 may be past the end index
invalid write of size 4
at 0x1CBBA959: com::sun::star::i18n::BreakIterator_th::makeIndex(rtl::OUString const&, int) (breakiterator_th.cxx:139)
by 0x1CBB4AA2: com::sun::star::i18n::BreakIterator_CTL::previousCharacters(rtl::OUString const&, int, com::sun::star::lang::Locale const&, short, int, int&) (breakiterator_ctl.cxx:61)
by 0x1CBB544F: com::sun::star::i18n::BreakIteratorImpl::previousCharacters(rtl::OUString const&, int, com::sun::star::lang::Locale const&, short, int, int&) (breakiteratorImpl.cxx:64)
by 0xA29D29A: ServerFontLayout::setNeedFallback(ImplLayoutArgs&, int, bool) (gcach_layout.cxx:99)
Change-Id: I201f24cb6773b5aa1a81dea90ea906d3d4355053
Diffstat (limited to 'i18npool')
| -rw-r--r-- | i18npool/source/breakiterator/breakiterator_th.cxx | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/i18npool/source/breakiterator/breakiterator_th.cxx b/i18npool/source/breakiterator/breakiterator_th.cxx index 17a51ea61924..08a9400d69ad 100644 --- a/i18npool/source/breakiterator/breakiterator_th.cxx +++ b/i18npool/source/breakiterator/breakiterator_th.cxx @@ -103,7 +103,7 @@ static sal_Int32 SAL_CALL getACell(const sal_Unicode *text, sal_Int32 pos, sal_I #define is_Thai(c) (0x0e00 <= c && c <= 0x0e7f) // Unicode definition for Thai -void SAL_CALL BreakIterator_th::makeIndex(const OUString& Text, sal_Int32 nStartPos) +void SAL_CALL BreakIterator_th::makeIndex(const OUString& Text, sal_Int32 const nStartPos) throw(RuntimeException) { if (Text != cachedText) { @@ -123,18 +123,20 @@ void SAL_CALL BreakIterator_th::makeIndex(const OUString& Text, sal_Int32 nStart return; const sal_Unicode* str = cachedText.getStr(); - sal_Int32 len = cachedText.getLength(), startPos, endPos; + sal_Int32 const len = cachedText.getLength(); - startPos = nStartPos; + sal_Int32 startPos = nStartPos; while (startPos > 0 && is_Thai(str[startPos-1])) startPos--; - endPos = nStartPos+1; + sal_Int32 endPos = std::min(len, nStartPos+1); while (endPos < len && is_Thai(str[endPos])) endPos++; sal_Int32 start, end, pos; pos = start = end = startPos; + assert(endPos <= cellIndexSize); while (pos < endPos) { end += getACell(str, start, endPos); + assert(end <= cellIndexSize); while (pos < end) { nextCellIndex[pos] = end; previousCellIndex[pos] = start; |