diff options
author | Behdad Esfahbod <behdad@behdad.org> | 2010-09-23 15:49:57 -0400 |
---|---|---|
committer | Behdad Esfahbod <behdad@behdad.org> | 2010-09-28 14:24:51 -0400 |
commit | ab5e0df8a7a7970e6e4ec03c13a15f7d04cc7594 (patch) | |
tree | 5be23ff9118daafb5c91a8220acedce41cd0e15c /pango/opentype/hb-ot-layout-gpos-private.hh | |
parent | 9724624b47c72802c6d9584d07e79d627180f8f2 (diff) | |
download | pango-ab5e0df8a7a7970e6e4ec03c13a15f7d04cc7594.tar.gz |
Bug 626966 - SIGFPE _hb_sanitize_array
Fix two div-by-zero's. Both have been fixed upstream.
Diffstat (limited to 'pango/opentype/hb-ot-layout-gpos-private.hh')
-rw-r--r-- | pango/opentype/hb-ot-layout-gpos-private.hh | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/pango/opentype/hb-ot-layout-gpos-private.hh b/pango/opentype/hb-ot-layout-gpos-private.hh index e68739ed..cdd28d2c 100644 --- a/pango/opentype/hb-ot-layout-gpos-private.hh +++ b/pango/opentype/hb-ot-layout-gpos-private.hh @@ -337,6 +337,7 @@ struct AnchorMatrix inline bool sanitize (SANITIZE_ARG_DEF, unsigned int cols) { TRACE_SANITIZE (); if (!SANITIZE_SELF ()) return false; + if (rows > 0 && cols >= ((unsigned int) -1) / rows) return false; unsigned int count = rows * cols; if (!SANITIZE_ARRAY (matrix, matrix[0].get_size (), count)) return false; for (unsigned int i = 0; i < count; i++) |