diff options
| author | Takeshi Abe <tabe@fixedpoint.jp> | 2015-10-15 18:16:53 +0900 |
|---|---|---|
| committer | Miklos Vajna <vmiklos@collabora.co.uk> | 2015-11-18 13:10:05 +0000 |
| commit | e401cb5c54d7f7d6c7a24c539acf35c7ec94d75b (patch) | |
| tree | 1f34c96be7465f20471b40f8bf4b5182c3a15622 /vcl | |
| parent | aaf3bc89d722ea3c034fd417cc36db9e4bbc125f (diff) | |
tdf#94008 Crash opening password protected file - CJK UI
This fixes a buffer overflow writing over the end of pCaretXArray,
which can happen e.g. when drawing mnemonics in the password dialog.
Based on a similar calculation of nCurrIdx found in
GenericSalLayout::GetCaretPositions().
Change-Id: I7d723cf8cfaeb66f340c7d9ea5b3bc728c6d6209
Reviewed-on: https://gerrit.libreoffice.org/19385
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: jan iversen <jani@documentfoundation.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit f630b6d5f165c8c507b8904b99594936edfd8da0)
Reviewed-on: https://gerrit.libreoffice.org/20031
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/win/source/gdi/winlayout.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/vcl/win/source/gdi/winlayout.cxx b/vcl/win/source/gdi/winlayout.cxx index 0d733ee58bfc..abbdc5a334c4 100644 --- a/vcl/win/source/gdi/winlayout.cxx +++ b/vcl/win/source/gdi/winlayout.cxx @@ -1905,7 +1905,7 @@ void UniscribeLayout::GetCaretPositions( int nMaxIdx, long* pCaretXArray ) const for(; (i < rVisualItem.mnEndCharPos) && (i < mnEndCharPos); ++i ) { int j = mpLogClusters[ i ] + rVisualItem.mnMinGlyphPos; - int nCurrIdx = i * 2; + int nCurrIdx = (i - mnMinCharPos) * 2; if( !rVisualItem.IsRTL() ) { // normal positions for LTR case |