summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Stahl <mstahl@redhat.com>2015-05-22 20:53:05 +0200
committerMichael Stahl <mstahl@redhat.com>2015-05-22 20:58:43 +0200
commit9db629b8a1fa9b63bc320f8d47594ec82511a9c5 (patch)
treecb9b321857ba28b4ae0b9cd141e22bb5adca3a50
parentb2cf675b827912feb5edfbca1ea902d1ab92ed6b (diff)
tdf#90809: i18npool: fix crash in Thai break iterator
endPos = nStartPos + 1 may be past the end index invalid write of size 4 at 0x1CBBA959: com::sun::star::i18n::BreakIterator_th::makeIndex(rtl::OUString const&, int) (breakiterator_th.cxx:139) by 0x1CBB4AA2: com::sun::star::i18n::BreakIterator_CTL::previousCharacters(rtl::OUString const&, int, com::sun::star::lang::Locale const&, short, int, int&) (breakiterator_ctl.cxx:61) by 0x1CBB544F: com::sun::star::i18n::BreakIteratorImpl::previousCharacters(rtl::OUString const&, int, com::sun::star::lang::Locale const&, short, int, int&) (breakiteratorImpl.cxx:64) by 0xA29D29A: ServerFontLayout::setNeedFallback(ImplLayoutArgs&, int, bool) (gcach_layout.cxx:99) Change-Id: I201f24cb6773b5aa1a81dea90ea906d3d4355053
-rw-r--r--i18npool/source/breakiterator/breakiterator_th.cxx10
1 files changed, 6 insertions, 4 deletions
diff --git a/i18npool/source/breakiterator/breakiterator_th.cxx b/i18npool/source/breakiterator/breakiterator_th.cxx
index 17a51ea61924..08a9400d69ad 100644
--- a/i18npool/source/breakiterator/breakiterator_th.cxx
+++ b/i18npool/source/breakiterator/breakiterator_th.cxx
@@ -103,7 +103,7 @@ static sal_Int32 SAL_CALL getACell(const sal_Unicode *text, sal_Int32 pos, sal_I
#define is_Thai(c) (0x0e00 <= c && c <= 0x0e7f) // Unicode definition for Thai
-void SAL_CALL BreakIterator_th::makeIndex(const OUString& Text, sal_Int32 nStartPos)
+void SAL_CALL BreakIterator_th::makeIndex(const OUString& Text, sal_Int32 const nStartPos)
throw(RuntimeException)
{
if (Text != cachedText) {
@@ -123,18 +123,20 @@ void SAL_CALL BreakIterator_th::makeIndex(const OUString& Text, sal_Int32 nStart
return;
const sal_Unicode* str = cachedText.getStr();
- sal_Int32 len = cachedText.getLength(), startPos, endPos;
+ sal_Int32 const len = cachedText.getLength();
- startPos = nStartPos;
+ sal_Int32 startPos = nStartPos;
while (startPos > 0 && is_Thai(str[startPos-1])) startPos--;
- endPos = nStartPos+1;
+ sal_Int32 endPos = std::min(len, nStartPos+1);
while (endPos < len && is_Thai(str[endPos])) endPos++;
sal_Int32 start, end, pos;
pos = start = end = startPos;
+ assert(endPos <= cellIndexSize);
while (pos < endPos) {
end += getACell(str, start, endPos);
+ assert(end <= cellIndexSize);
while (pos < end) {
nextCellIndex[pos] = end;
previousCellIndex[pos] = start;