提交 adec89fb 编写于 作者: P prr

8074098: 2D_Font/Bug8067699 test fails with SIGBUS crash on Solaris Sparc

Reviewed-by: bae, mschoene
上级 335d110f
......@@ -54,6 +54,10 @@ void MorphTableHeader::process(const LETableReference &base, LEGlyphStorage &gly
for (chain = 0; LE_SUCCESS(success) && (chain < chainCount); chain += 1) {
if (chain > 0) {
le_uint32 chainLength = SWAPL(chainHeader->chainLength);
if (chainLength & 0x03) { // incorrect alignment for 32 bit tables
success = LE_MEMORY_ALLOCATION_ERROR; // as good a choice as any
return;
}
chainHeader.addOffset(chainLength, success);
}
FeatureFlags defaultFlags = SWAPL(chainHeader->defaultFlags);
......@@ -66,6 +70,10 @@ void MorphTableHeader::process(const LETableReference &base, LEGlyphStorage &gly
for (subtable = 0; LE_SUCCESS(success) && (subtable < nSubtables); subtable += 1) {
if (subtable > 0) {
le_int16 length = SWAPW(subtableHeader->length);
if (length & 0x03) { // incorrect alignment for 32 bit tables
success = LE_MEMORY_ALLOCATION_ERROR; // as good a choice as any
return;
}
subtableHeader.addOffset(length, success);
}
SubtableCoverage coverage = SWAPW(subtableHeader->coverage);
......
......@@ -59,6 +59,10 @@ void MorphTableHeader2::process(const LEReferenceTo<MorphTableHeader2> &base, LE
for (chain = 0; LE_SUCCESS(success) && (chain < chainCount); chain++) {
if (chain>0) {
le_uint32 chainLength = SWAPL(chainHeader->chainLength);
if (chainLength & 0x03) { // incorrect alignment for 32 bit tables
success = LE_MEMORY_ALLOCATION_ERROR; // as good a choice as any
return;
}
chainHeader.addOffset(chainLength, success); // Don't increment the first time
}
FeatureFlags flag = SWAPL(chainHeader->defaultFlags);
......@@ -188,6 +192,10 @@ void MorphTableHeader2::process(const LEReferenceTo<MorphTableHeader2> &base, LE
for (subtable = 0; LE_SUCCESS(success) && subtable < nSubtables; subtable++) {
if(subtable>0) {
le_uint32 length = SWAPL(subtableHeader->length);
if (length & 0x03) { // incorrect alignment for 32 bit tables
success = LE_MEMORY_ALLOCATION_ERROR; // as good a choice as any
return;
}
subtableHeader.addOffset(length, success); // Don't addOffset for the last entry.
}
le_uint32 coverage = SWAPL(subtableHeader->coverage);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册