Files
main/network/web/chromium-browser/files/arch/chromium-webkit-buffer-overflow.patch
T
2016-01-31 08:10:48 +02:00

25 lines
1.1 KiB
Diff
Executable File

diff --git a/Source/platform/fonts/shaping/HarfBuzzShaper.cpp b/Source/platform/fonts/shaping/HarfBuzzShaper.cpp
index 87441d9..a90b925 100644
--- third_party/WebKit//Source/platform/fonts/shaping/HarfBuzzShaper.cpp
+++ third_party/WebKit//Source/platform/fonts/shaping/HarfBuzzShaper.cpp
@@ -702,7 +702,7 @@ static inline void resolveRunBasedOnScriptValue(Vector<CandidateRun>& runs,
static inline bool resolveCandidateRuns(Vector<CandidateRun>& runs)
{
- UScriptCode scriptExtensions[8];
+ UScriptCode scriptExtensions[USCRIPT_CODE_LIMIT];
UErrorCode errorCode = U_ZERO_ERROR;
size_t length = runs.size();
size_t nextResolvedRun = 0;
@@ -714,7 +714,8 @@ static inline bool resolveCandidateRuns(Vector<CandidateRun>& runs)
run.script = i > 0 ? runs[i - 1].script : USCRIPT_COMMON;
int extensionsLength = uscript_getScriptExtensions(run.character,
- scriptExtensions, sizeof(scriptExtensions), &errorCode);
+ scriptExtensions, sizeof(scriptExtensions) / sizeof(scriptExtensions[0]),
+ &errorCode);
if (U_FAILURE(errorCode))
return false;