diff options
| author | Simon Tatham <anakin@pobox.com> | 2004-08-04 16:27:28 +0000 |
|---|---|---|
| committer | Simon Tatham <anakin@pobox.com> | 2004-08-04 16:27:28 +0000 |
| commit | 8ec4d9f16a5bde1d821847e84075909d9f79bac1 (patch) | |
| tree | 4261c49cf65f1f484a63dcc8d4a0688b49c10a75 | |
| parent | b75127515b10322081512606885af6d913117ee4 (diff) | |
| download | halibut-8ec4d9f16a5bde1d821847e84075909d9f79bac1.zip halibut-8ec4d9f16a5bde1d821847e84075909d9f79bac1.tar.gz halibut-8ec4d9f16a5bde1d821847e84075909d9f79bac1.tar.bz2 halibut-8ec4d9f16a5bde1d821847e84075909d9f79bac1.tar.xz | |
Explicit bounds checking on the bmp[] array.
[originally from svn r4400]
| -rw-r--r-- | bk_paper.c | 7 |
1 files changed, 5 insertions, 2 deletions
@@ -1318,7 +1318,9 @@ static int string_width(font_data *font, wchar_t const *string, int *errs) for (; *string; string++) { int index; - index = font->bmp[(unsigned short)*string]; + index = (*string < 0 || *string > 0xFFFF ? 0xFFFF : + font->bmp[*string]); + if (index == 0xFFFF) { if (errs) *errs = 1; @@ -1766,7 +1768,8 @@ static int render_string(page_data *page, font_data *font, int fontsize, textpos = textwid = 0; while (*str) { - glyph = font->bmp[*str]; + glyph = (*str < 0 || *str > 0xFFFF ? 0xFFFF : + font->bmp[*str]); if (glyph == 0xFFFF) { str++; |