From f0c7540c4e217a7354072365a7301453d1e25b80 Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Thu, 20 Aug 2009 14:01:37 -0400
Subject: [PATCH] Bug 592484 -  invalid write in HB

Fix off-by-one.
---
 src/hb-ot-layout.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/hb-ot-layout.cc b/src/hb-ot-layout.cc
index 8d0a25a4..88823271 100644
--- a/src/hb-ot-layout.cc
+++ b/src/hb-ot-layout.cc
@@ -226,8 +226,8 @@ _hb_ot_layout_set_glyph_class (hb_face_t                  *face,
     unsigned char *new_klasses;
 
     new_len = len == 0 ? 120 : 2 * len;
-    if (new_len > 65535)
-      new_len = 65535;
+    if (new_len > 65536)
+      new_len = 65536;
     new_klasses = (unsigned char *) realloc (layout->new_gdef.klasses, new_len * sizeof (unsigned char));
 
     if (HB_UNLIKELY (!new_klasses))
-- 
GitLab