Blame SOURCES/icu.rhbz1074549.CVE-2013-5907.patch

f9b135
f9b135
# erAck: resolves https://bugzilla.redhat.com/show_bug.cgi?id=1074549
f9b135
# Based on http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/9d29c19f1de1
f9b135
# where a/src/share/native/sun/font/layout/LookupProcessor.cpp is
f9b135
# icu/source/layout/LookupProcessor.cpp
f9b135
# Adapted to LayoutEngine "patch" and subsequent patches.
f9b135
# Note that
f9b135
#@@ -246,7 +249,7 @@
f9b135
#-      featureReferences += SWAPW(featureTable->lookupCount);
f9b135
#+      featureReferences += SWAPW(requiredFeatureTable->lookupCount);
f9b135
# was already applied with icu.8800.freeserif.crash.patch that also added
f9b135
#+      if (requiredFeatureTable.isValid()) {
f9b135
# and is a slightly enhanced version of
f9b135
# https://ssl.icu-project.org/trac/ticket/8800 and/or
f9b135
# https://ssl.icu-project.org/trac/ticket/8320
f9b135
f9b135
--- prev.icu/source/layout/LookupProcessor.cpp	2014-03-11 20:46:53.288819882 +0100
f9b135
+++ icu/source/layout/LookupProcessor.cpp	2014-03-11 20:54:43.153370234 +0100
f9b135
@@ -113,7 +113,7 @@
f9b135
 le_int32 LookupProcessor::selectLookups(const LEReferenceTo<FeatureTable> &featureTable, FeatureMask featureMask, le_int32 order, LEErrorCode &success)
f9b135
 {
f9b135
   le_uint16 lookupCount = featureTable.isValid()? SWAPW(featureTable->lookupCount) : 0;
f9b135
-    le_int32  store = order;
f9b135
+    le_uint32  store = (le_uint32)order;
f9b135
     
f9b135
     LEReferenceToArrayOf<le_uint16> lookupListIndexArray(featureTable, success, featureTable->lookupListIndexArray, lookupCount);
f9b135
 
f9b135
@@ -122,6 +122,9 @@
f9b135
       if (lookupListIndex >= lookupSelectCount) {
f9b135
         continue;
f9b135
       }
f9b135
+      if (store >= lookupOrderCount) {
f9b135
+        continue;
f9b135
+      }
f9b135
       
f9b135
       lookupSelectArray[lookupListIndex] |= featureMask;
f9b135
       lookupOrderArray[store++] = lookupListIndex;