diff options
author | Jessica Wagantall <jwagantall@cyngn.com> | 2016-02-01 18:40:39 -0800 |
---|---|---|
committer | Jessica Wagantall <jwagantall@cyngn.com> | 2016-02-01 18:48:31 -0800 |
commit | 0ef148d41454016fdbbf31a5d035ee526a55631b (patch) | |
tree | 7bcf2ce6b7cd2cf91c8703780bfba13274f55b80 | |
parent | 4a0cff85eb8bbe5e61c4118c54a21bf18d0e9134 (diff) | |
parent | f6771c0a11d5030e84a9997d77479a0ee03a2398 (diff) | |
download | android_frameworks_minikin-0ef148d41454016fdbbf31a5d035ee526a55631b.tar.gz android_frameworks_minikin-0ef148d41454016fdbbf31a5d035ee526a55631b.tar.bz2 android_frameworks_minikin-0ef148d41454016fdbbf31a5d035ee526a55631b.zip |
Merge tag 'android-5.1.1_r34' into HEAD
Android 5.1.1 release 34
Ticket: CYNGNOS-1522
Change-Id: I7600519992d025004a8b59b9c9f650446d6f97ca
-rw-r--r-- | libs/minikin/CmapCoverage.cpp | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/libs/minikin/CmapCoverage.cpp b/libs/minikin/CmapCoverage.cpp index 7503372..6431000 100644 --- a/libs/minikin/CmapCoverage.cpp +++ b/libs/minikin/CmapCoverage.cpp @@ -29,11 +29,12 @@ namespace android { // These could perhaps be optimized to use __builtin_bswap16 and friends. static uint32_t readU16(const uint8_t* data, size_t offset) { - return data[offset] << 8 | data[offset + 1]; + return ((uint32_t)data[offset]) << 8 | ((uint32_t)data[offset + 1]); } static uint32_t readU32(const uint8_t* data, size_t offset) { - return data[offset] << 24 | data[offset + 1] << 16 | data[offset + 2] << 8 | data[offset + 3]; + return ((uint32_t)data[offset]) << 24 | ((uint32_t)data[offset + 1]) << 16 | + ((uint32_t)data[offset + 2]) << 8 | ((uint32_t)data[offset + 3]); } static void addRange(vector<uint32_t> &coverage, uint32_t start, uint32_t end) { @@ -101,11 +102,13 @@ static bool getCoverageFormat12(vector<uint32_t>& coverage, const uint8_t* data, const size_t kGroupSize = 12; const size_t kStartCharCodeOffset = 0; const size_t kEndCharCodeOffset = 4; + const size_t kMaxNGroups = 0xfffffff0 / kGroupSize; // protection against overflow + // For all values < kMaxNGroups, kFirstGroupOffset + nGroups * kGroupSize fits in 32 bits. if (kFirstGroupOffset > size) { return false; } uint32_t nGroups = readU32(data, kNGroupsOffset); - if (kFirstGroupOffset + nGroups * kGroupSize > size) { + if (nGroups >= kMaxNGroups || kFirstGroupOffset + nGroups * kGroupSize > size) { return false; } for (uint32_t i = 0; i < nGroups; i++) { |