diff options
author | Matthias Clasen <mclasen@redhat.com> | 2019-07-15 07:34:19 -0400 |
---|---|---|
committer | Matthias Clasen <mclasen@redhat.com> | 2019-07-15 07:34:19 -0400 |
commit | 130eb6f16d35ccd36d2b5759ba6aa3decb014162 (patch) | |
tree | 15ed0589b320957656fb27dc6c473769891982a0 /pango/pango-layout.c | |
parent | 037ad011d2dc1b23374ca8cd1ed9dcf5b90230ba (diff) | |
download | pango-130eb6f16d35ccd36d2b5759ba6aa3decb014162.tar.gz |
layout: Avoid access-after-free
insert_run (... TRUE) frees the need_hyphen array,
so we need to check for the hyphen beforehand.
Diffstat (limited to 'pango/pango-layout.c')
-rw-r--r-- | pango/pango-layout.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/pango/pango-layout.c b/pango/pango-layout.c index 37aeed72..fb732d7d 100644 --- a/pango/pango-layout.c +++ b/pango/pango-layout.c @@ -3694,8 +3694,9 @@ process_item (PangoLayout *layout, if (break_num_chars == item->num_chars) { + gboolean insert_hyphen = break_needs_hyphen (layout, state, break_num_chars); insert_run (line, state, item, TRUE); - if (break_needs_hyphen (layout, state, break_num_chars)) + if (insert_hyphen) insert_hyphen_after (line, state, item); return BREAK_ALL_FIT; @@ -3707,6 +3708,7 @@ process_item (PangoLayout *layout, else { PangoItem *new_item; + gboolean insert_hyphen = break_needs_hyphen (layout, state, break_num_chars); length = g_utf8_offset_to_pointer (layout->text + item->offset, break_num_chars) - (layout->text + item->offset); @@ -3721,7 +3723,7 @@ process_item (PangoLayout *layout, /* Shaped items should never be broken */ g_assert (!shape_set); - if (break_needs_hyphen (layout, state, break_num_chars)) + if (insert_hyphen) insert_hyphen_after (line, state, new_item); state->log_widths_offset += break_num_chars; |