diff options
| author | Jun Fang <jun_fang@foxitsoftware.com> | 2014-09-15 21:50:59 -0700 |
|---|---|---|
| committer | Jun Fang <jun_fang@foxitsoftware.com> | 2014-09-15 21:50:59 -0700 |
| commit | 4481496892d3d9555556df54edd6f98e9f63645e (patch) | |
| tree | 042acb7e85bd22461b39fe0828026bd2b68c6457 /core/include/fxcodec | |
| parent | 4cce875b219ea772da8d528287b0e6431dcda48e (diff) | |
| download | pdfium-4481496892d3d9555556df54edd6f98e9f63645e.tar.xz | |
Add a boundary check before accessing the table of 'Index to Location'
Before this fix, only |gindex < face->num_locations| is checked. However, the pointer, p, will be moved to next location in the first FT_NEXT_ULONG or FT_NEXT_USHORT. It may cause a crashier. So a boundary check is needed before the second FT_NEXT_ULONG or FT_NEXT_USHORT.
BUG=412457
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/571833002
Diffstat (limited to 'core/include/fxcodec')
0 files changed, 0 insertions, 0 deletions