未验证 提交 7a9d643c 编写于 作者: E Ebrahim Byagowi 提交者: GitHub

Fix unintialized memory read in cmap subset (#1826)

上级 a6065d05
...@@ -878,7 +878,7 @@ struct cmap ...@@ -878,7 +878,7 @@ struct cmap
cmap_plan->has_ms_bmp = find_subtable (3, 1); cmap_plan->has_ms_bmp = find_subtable (3, 1);
cmap_plan->has_ms_ucs4 = find_subtable (3, 10); cmap_plan->has_ms_ucs4 = find_subtable (3, 10);
cmap_plan->num_enc_records = cmap_plan->has_unicode_bmp + cmap_plan->has_unicode_ucs4 + cmap_plan->has_ms_bmp + cmap_plan->has_ms_ucs4; cmap_plan->num_enc_records = cmap_plan->has_unicode_bmp + cmap_plan->has_unicode_ucs4 + cmap_plan->has_ms_bmp + cmap_plan->has_ms_ucs4;
if (unlikely (!CmapSubtableFormat4::create_sub_table_plan (plan, &cmap_plan->format4_segments))) if (unlikely (!CmapSubtableFormat4::create_sub_table_plan (plan, &cmap_plan->format4_segments)))
return false; return false;
...@@ -979,6 +979,14 @@ struct cmap ...@@ -979,6 +979,14 @@ struct cmap
if (unlikely (!format12.serialize (&c, cmap_subset_plan.format12_groups))) if (unlikely (!format12.serialize (&c, cmap_subset_plan.format12_groups)))
return false; return false;
} }
else
{
// FIXME: Merge this with above or, remove and tweak #final_size
// and rebase all the tests expectations
HBUINT32 empty;
empty = 0;
for (unsigned int i = 0; i < 4; ++i) c.copy (empty);
}
c.end_serialize (); c.end_serialize ();
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册