From 9db629b8a1fa9b63bc320f8d47594ec82511a9c5 Mon Sep 17 00:00:00 2001 From: Michael Stahl Date: Fri, 22 May 2015 20:53:05 +0200 Subject: tdf#90809: i18npool: fix crash in Thai break iterator endPos = nStartPos + 1 may be past the end index invalid write of size 4 at 0x1CBBA959: com::sun::star::i18n::BreakIterator_th::makeIndex(rtl::OUString const&, int) (breakiterator_th.cxx:139) by 0x1CBB4AA2: com::sun::star::i18n::BreakIterator_CTL::previousCharacters(rtl::OUString const&, int, com::sun::star::lang::Locale const&, short, int, int&) (breakiterator_ctl.cxx:61) by 0x1CBB544F: com::sun::star::i18n::BreakIteratorImpl::previousCharacters(rtl::OUString const&, int, com::sun::star::lang::Locale const&, short, int, int&) (breakiteratorImpl.cxx:64) by 0xA29D29A: ServerFontLayout::setNeedFallback(ImplLayoutArgs&, int, bool) (gcach_layout.cxx:99) Change-Id: I201f24cb6773b5aa1a81dea90ea906d3d4355053 --- i18npool/source/breakiterator/breakiterator_th.cxx | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'i18npool') diff --git a/i18npool/source/breakiterator/breakiterator_th.cxx b/i18npool/source/breakiterator/breakiterator_th.cxx index 17a51ea61924..08a9400d69ad 100644 --- a/i18npool/source/breakiterator/breakiterator_th.cxx +++ b/i18npool/source/breakiterator/breakiterator_th.cxx @@ -103,7 +103,7 @@ static sal_Int32 SAL_CALL getACell(const sal_Unicode *text, sal_Int32 pos, sal_I #define is_Thai(c) (0x0e00 <= c && c <= 0x0e7f) // Unicode definition for Thai -void SAL_CALL BreakIterator_th::makeIndex(const OUString& Text, sal_Int32 nStartPos) +void SAL_CALL BreakIterator_th::makeIndex(const OUString& Text, sal_Int32 const nStartPos) throw(RuntimeException) { if (Text != cachedText) { @@ -123,18 +123,20 @@ void SAL_CALL BreakIterator_th::makeIndex(const OUString& Text, sal_Int32 nStart return; const sal_Unicode* str = cachedText.getStr(); - sal_Int32 len = cachedText.getLength(), startPos, endPos; + sal_Int32 const len = cachedText.getLength(); - startPos = nStartPos; + sal_Int32 startPos = nStartPos; while (startPos > 0 && is_Thai(str[startPos-1])) startPos--; - endPos = nStartPos+1; + sal_Int32 endPos = std::min(len, nStartPos+1); while (endPos < len && is_Thai(str[endPos])) endPos++; sal_Int32 start, end, pos; pos = start = end = startPos; + assert(endPos <= cellIndexSize); while (pos < endPos) { end += getACell(str, start, endPos); + assert(end <= cellIndexSize); while (pos < end) { nextCellIndex[pos] = end; previousCellIndex[pos] = start; -- cgit