diff options
Diffstat (limited to 'pango/opentype/harfbuzz-gpos.c')
| -rw-r--r-- | pango/opentype/harfbuzz-gpos.c | 22 |
1 files changed, 18 insertions, 4 deletions
diff --git a/pango/opentype/harfbuzz-gpos.c b/pango/opentype/harfbuzz-gpos.c index 2961940c..c78dcba4 100644 --- a/pango/opentype/harfbuzz-gpos.c +++ b/pango/opentype/harfbuzz-gpos.c @@ -2080,9 +2080,13 @@ static void Free_BaseArray( HB_BaseArray* ba, if ( ba->BaseRecord ) { br = ba->BaseRecord; - bans = br[0].BaseAnchor; - FREE( bans ); + if ( ba->BaseCount ) + { + bans = br[0].BaseAnchor; + FREE( bans ); + } + FREE( br ); } } @@ -2811,9 +2815,13 @@ static void Free_Mark2Array( HB_Mark2Array* m2a, if ( m2a->Mark2Record ) { m2r = m2a->Mark2Record; - m2ans = m2r[0].Mark2Anchor; - FREE( m2ans ); + if ( m2a->Mark2Count ) + { + m2ans = m2r[0].Mark2Anchor; + FREE( m2ans ); + } + FREE( m2r ); } } @@ -3857,6 +3865,9 @@ static HB_Error Lookup_ContextPos2( GPOS_Instance* gpi, if ( error ) return error; + if (cpf2->MaxContextLength < 1) + return HB_Err_Not_Covered; + if ( ALLOC_ARRAY( classes, cpf2->MaxContextLength, HB_UShort ) ) return error; @@ -5139,6 +5150,9 @@ static HB_Error Lookup_ChainContextPos2( return error; known_backtrack_classes = 0; + if (ccpf2->MaxInputLength < 1) + return HB_Err_Not_Covered; + if ( ALLOC_ARRAY( input_classes, ccpf2->MaxInputLength, HB_UShort ) ) goto End3; known_input_classes = 1; |