Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
OpenHarmony
Third Party Harfbuzz
提交
eba8b4f6
T
Third Party Harfbuzz
项目概览
OpenHarmony
/
Third Party Harfbuzz
接近 2 年 前同步成功
通知
1
Star
18
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
T
Third Party Harfbuzz
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
提交
eba8b4f6
编写于
3月 29, 2010
作者:
B
Behdad Esfahbod
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
GNOME Bug 613015 - [HB] Does not sanitize Device tables referenced from ValueRecords
上级
673a4efc
变更
1
隐藏空白更改
内联
并排
Showing
1 changed file
with
36 addition
and
11 deletion
+36
-11
src/hb-ot-layout-gpos-private.hh
src/hb-ot-layout-gpos-private.hh
+36
-11
未找到文件。
src/hb-ot-layout-gpos-private.hh
浏览文件 @
eba8b4f6
...
...
@@ -51,9 +51,9 @@ struct ValueFormat : USHORT
xAdvDevice
=
0x0040
,
/* Includes horizontal Device table for advance */
yAdvDevice
=
0x0080
,
/* Includes vertical Device table for advance */
ignored
=
0x0F00
,
/* Was used in TrueType Open for MM fonts */
reserved
=
0xF000
/* For future use */
reserved
=
0xF000
,
/* For future use */
devices
=
0x00F0
,
/* Mask for having any Device table */
devices
=
0x00F0
/* Mask for having any Device table */
};
/* All fields are options. Only those available advance the value pointer. */
...
...
@@ -422,7 +422,7 @@ struct SinglePosFormat1
inline
bool
sanitize
(
SANITIZE_ARG_DEF
)
{
TRACE_SANITIZE
();
return
SANITIZE_SELF
()
&&
SANITIZE_THIS
(
coverage
)
&&
SANITIZE_MEM
(
values
,
valueFormat
.
get_size
()
);
valueFormat
.
sanitize_value
(
SANITIZE_ARG
,
CHARP
(
this
),
values
);
}
private:
...
...
@@ -464,7 +464,7 @@ struct SinglePosFormat2
inline
bool
sanitize
(
SANITIZE_ARG_DEF
)
{
TRACE_SANITIZE
();
return
SANITIZE_SELF
()
&&
SANITIZE_THIS
(
coverage
)
&&
SANITIZE_MEM
(
values
,
valueFormat
.
get_size
()
*
valueCount
);
valueFormat
.
sanitize_values
(
SANITIZE_ARG
,
CHARP
(
this
),
values
,
valueCount
);
}
private:
...
...
@@ -531,6 +531,7 @@ struct PairSet
{
friend
struct
PairPosFormat1
;
/* Note: Doesn't sanitize the Device entries in the ValueRecord */
inline
bool
sanitize
(
SANITIZE_ARG_DEF
,
unsigned
int
format_len
)
{
TRACE_SANITIZE
();
if
(
!
SANITIZE_SELF
())
return
false
;
...
...
@@ -570,12 +571,11 @@ struct PairPosFormat1
j
++
;
}
const
PairSet
&
pair_set
=
this
+
pairSet
[
index
];
unsigned
int
len1
=
valueFormat1
.
get_len
();
unsigned
int
len2
=
valueFormat2
.
get_len
();
unsigned
int
record_size
=
USHORT
::
get_size
()
*
(
1
+
len1
+
len2
);
const
PairSet
&
pair_set
=
this
+
pairSet
[
index
];
unsigned
int
count
=
pair_set
.
len
;
const
PairValueRecord
*
record
=
pair_set
.
array
;
for
(
unsigned
int
i
=
0
;
i
<
count
;
i
++
)
...
...
@@ -597,9 +597,29 @@ struct PairPosFormat1
inline
bool
sanitize
(
SANITIZE_ARG_DEF
)
{
TRACE_SANITIZE
();
return
SANITIZE_SELF
()
&&
SANITIZE_THIS
(
coverage
)
&&
pairSet
.
sanitize
(
SANITIZE_ARG
,
CONST_CHARP
(
this
),
valueFormat1
.
get_len
()
+
valueFormat2
.
get_len
());
unsigned
int
len1
=
valueFormat1
.
get_len
();
unsigned
int
len2
=
valueFormat2
.
get_len
();
if
(
!
(
SANITIZE_SELF
()
&&
SANITIZE_THIS
(
coverage
)
&&
pairSet
.
sanitize
(
SANITIZE_ARG
,
CONST_CHARP
(
this
),
len1
+
len2
)))
return
false
;
if
(
!
(
valueFormat1
.
has_device
()
||
valueFormat2
.
has_device
()))
return
true
;
unsigned
int
stride
=
1
+
len1
+
len2
;
unsigned
int
count1
=
pairSet
.
len
;
for
(
unsigned
int
i
=
0
;
i
<
count1
;
i
++
)
{
const
PairSet
&
pair_set
=
this
+
pairSet
[
i
];
unsigned
int
count2
=
pair_set
.
len
;
const
PairValueRecord
*
record
=
pair_set
.
array
;
if
(
!
(
valueFormat1
.
sanitize_values_stride_unsafe
(
SANITIZE_ARG
,
CHARP
(
this
),
&
record
->
values
[
0
],
count2
,
stride
)
&&
valueFormat2
.
sanitize_values_stride_unsafe
(
SANITIZE_ARG
,
CHARP
(
this
),
&
record
->
values
[
len1
],
count2
,
stride
)))
return
false
;
}
return
true
;
}
private:
...
...
@@ -668,9 +688,14 @@ struct PairPosFormat2
if
(
!
(
SANITIZE_SELF
()
&&
SANITIZE_THIS
(
coverage
)
&&
SANITIZE_THIS2
(
classDef1
,
classDef2
)))
return
false
;
unsigned
int
len1
=
valueFormat1
.
get_len
();
unsigned
int
len2
=
valueFormat2
.
get_len
();
unsigned
int
stride
=
len1
+
len2
;
unsigned
int
record_size
=
valueFormat1
.
get_size
()
+
valueFormat2
.
get_size
();
unsigned
int
len
=
class1Count
*
class2Count
;
return
SANITIZE_ARRAY
(
values
,
record_size
,
len
);
unsigned
int
count
=
(
unsigned
int
)
class1Count
*
(
unsigned
int
)
class2Count
;
return
SANITIZE_ARRAY
(
values
,
record_size
,
count
)
&&
valueFormat1
.
sanitize_values_stride_unsafe
(
SANITIZE_ARG
,
CHARP
(
this
),
&
values
[
0
],
count
,
stride
)
&&
valueFormat2
.
sanitize_values_stride_unsafe
(
SANITIZE_ARG
,
CHARP
(
this
),
&
values
[
len1
],
count
,
stride
);
}
private:
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录