提交 e5930722 编写于 作者: B Behdad Esfahbod

Fix invalid buffer access in OOM times

Hopefully fully fixes
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1856
上级 fcd6c338
......@@ -1002,7 +1002,8 @@ static inline bool apply_lookup (hb_apply_context_t *c,
if (idx == 0 && lookupRecord[i].lookupListIndex == c->lookup_index)
continue;
buffer->move_to (match_positions[idx]);
if (unlikely (!buffer->move_to (match_positions[idx])))
break;
unsigned int orig_len = buffer->backtrack_len () + buffer->lookahead_len ();
if (!c->recurse (lookupRecord[i].lookupListIndex))
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册