diff options
| author | Takeshi Abe <tabe@fixedpoint.jp> | 2015-10-15 18:16:53 +0900 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-11-16 14:41:39 +0000 |
| commit | f630b6d5f165c8c507b8904b99594936edfd8da0 (patch) | |
| tree | 69f8217a1fac454e0a54a2eae818800feaab079a /vcl/win | |
| parent | 6edc492efd6fe2de15c1ae306b400ca054772ad1 (diff) | |
tdf#94008 Crash opening password protected file - CJK UI
This fixes a buffer overflow writing over the end of pCaretXArray,
which can happen e.g. when drawing mnemonics in the password dialog.
Based on a similar calculation of nCurrIdx found in
GenericSalLayout::GetCaretPositions().
Change-Id: I7d723cf8cfaeb66f340c7d9ea5b3bc728c6d6209
Reviewed-on: https://gerrit.libreoffice.org/19385
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: jan iversen <jani@documentfoundation.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'vcl/win')
| -rw-r--r-- | vcl/win/source/gdi/winlayout.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/vcl/win/source/gdi/winlayout.cxx b/vcl/win/source/gdi/winlayout.cxx index 0dfce848c3d2..2409d4b36303 100644 --- a/vcl/win/source/gdi/winlayout.cxx +++ b/vcl/win/source/gdi/winlayout.cxx @@ -1986,7 +1986,7 @@ void UniscribeLayout::GetCaretPositions( int nMaxIdx, long* pCaretXArray ) const for(; (i < rVisualItem.mnEndCharPos) && (i < mnEndCharPos); ++i ) { int j = mpLogClusters[ i ] + rVisualItem.mnMinGlyphPos; - int nCurrIdx = i * 2; + int nCurrIdx = (i - mnMinCharPos) * 2; if( !rVisualItem.IsRTL() ) { // normal positions for LTR case |