Avoid overflow when updating attr listsattr-list-overflow

Avoid overflow when updating the end_index of
attributes in pango_attr_list_update. This is
a real risk, because end_index is commonly set
to G_MAXUINT to mean 'until the very end'.

Test included.

Fixes: #455

1 files changed, 4 insertions, 1 deletions

diff --git a/pango/pango-attributes.c b/pango/pango-attributes.c
index 38a41517..3ef76a70 100644
--- a/pango/pango-attributes.c
+++ b/pango/pango-attributes.c
@@ -1733,7 +1733,10 @@ pango_attr_list_update (PangoAttrList *list,
           }
         else if (attr->end_index >= pos + remove)
           {
-            attr->end_index += add - remove;
+            if (G_MAXUINT - attr->end_index < add - remove)
+              attr->end_index = G_MAXUINT;
+            else
+              attr->end_index += add - remove;
           }
       }
 }