diff options
| author | Behdad Esfahbod <behdad@behdad.org> | 2009-08-20 14:01:37 -0400 |
|---|---|---|
| committer | Behdad Esfahbod <behdad@behdad.org> | 2009-08-20 14:01:37 -0400 |
| commit | 4c68b4bf575e6d02c658507374c9fb3cb0f958c6 (patch) | |
| tree | 795f62aea629536d284ed7d8164db2c774362977 | |
| parent | 48d7faba771a738504e0c431c29458cac305275f (diff) | |
| download | pango-4c68b4bf575e6d02c658507374c9fb3cb0f958c6.tar.gz | |
Bug 592484 - invalid write in HB
Fix off-by-one.
| -rw-r--r-- | pango/opentype/hb-ot-layout.cc | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/pango/opentype/hb-ot-layout.cc b/pango/opentype/hb-ot-layout.cc index 8d0a25a4..88823271 100644 --- a/pango/opentype/hb-ot-layout.cc +++ b/pango/opentype/hb-ot-layout.cc @@ -226,8 +226,8 @@ _hb_ot_layout_set_glyph_class (hb_face_t *face, unsigned char *new_klasses; new_len = len == 0 ? 120 : 2 * len; - if (new_len > 65535) - new_len = 65535; + if (new_len > 65536) + new_len = 65536; new_klasses = (unsigned char *) realloc (layout->new_gdef.klasses, new_len * sizeof (unsigned char)); if (HB_UNLIKELY (!new_klasses)) |