| commit | 7763a6a02fcd4479111530b64b9f6e00899aad2d | |
| author | bashi@chromium.org <bashi@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | |
| Fri, 29 Jul 2011 01:58:29 +0000 (29 01:58 +0000) | ||
| committer | bashi@chromium.org <bashi@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | |
| Fri, 29 Jul 2011 01:58:29 +0000 (29 01:58 +0000) | ||
| tree | dc86148b6394239c2085d99430a48f369deb4706 | treesnapshot (tar.gz zip) |
| parent | ea41e2bcaff5770690f7d7033fbf1079c44a770d | commitdiff |
OOB read in harfbuzz with khmer character.
Sets face->tmpLogClusters[i] to the last valid value of |item->log_clusters|
when |i| exceeds the size of the |item->log_clusters|.
BUG=90134
TEST=checked with ASAN and ran webkit/tools/layout_tests/run_webkit_tests.sh
Review URL: http://codereview.chromium.org/7465036
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@94616 0039d316-1c4b-4281-b951-d872f2087c98
Sets face->tmpLogClusters[i] to the last valid value of |item->log_clusters|
when |i| exceeds the size of the |item->log_clusters|.
BUG=90134
TEST=checked with ASAN and ran webkit/tools/layout_tests/run_webkit_tests.sh
Review URL: http://codereview.chromium.org/7465036
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@94616 0039d316-1c4b-4281-b951-d872f2087c98
| third_party/harfbuzz/chromium.patch | diffblobblamehistory | |
| third_party/harfbuzz/src/harfbuzz-shaper.cpp | diffblobblamehistory |