diff options
Diffstat (limited to 'pango/opentype/hb-ot-layout-gpos-private.hh')
| -rw-r--r-- | pango/opentype/hb-ot-layout-gpos-private.hh | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/pango/opentype/hb-ot-layout-gpos-private.hh b/pango/opentype/hb-ot-layout-gpos-private.hh index e68739ed..cdd28d2c 100644 --- a/pango/opentype/hb-ot-layout-gpos-private.hh +++ b/pango/opentype/hb-ot-layout-gpos-private.hh @@ -337,6 +337,7 @@ struct AnchorMatrix inline bool sanitize (SANITIZE_ARG_DEF, unsigned int cols) { TRACE_SANITIZE (); if (!SANITIZE_SELF ()) return false; + if (rows > 0 && cols >= ((unsigned int) -1) / rows) return false; unsigned int count = rows * cols; if (!SANITIZE_ARRAY (matrix, matrix[0].get_size (), count)) return false; for (unsigned int i = 0; i < count; i++) |