vcl/win/source/gdi/winlayout.cxx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit f630b6d5f165c8c507b8904b99594936edfd8da0
Author: Takeshi Abe <t...@fixedpoint.jp>
Date: Thu Oct 15 18:16:53 2015 +0900
tdf#94008 Crash opening password protected file - CJK UI
This fixes a buffer overflow writing over the end of pCaretXArray,
which can happen e.g. when drawing mnemonics in the password dialog.
Based on a similar calculation of nCurrIdx found in
GenericSalLayout::GetCaretPositions().
Change-Id: I7d723cf8cfaeb66f340c7d9ea5b3bc728c6d6209
Reviewed-on: https://gerrit.libreoffice.org/19385
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: jan iversen <j...@documentfoundation.org>
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/vcl/win/source/gdi/winlayout.cxx b/vcl/win/source/gdi/winlayout.cxx
index 0dfce84..2409d4b 100644
--- a/vcl/win/source/gdi/winlayout.cxx
+++ b/vcl/win/source/gdi/winlayout.cxx
@@ -1986,7 +1986,7 @@ void UniscribeLayout::GetCaretPositions( int nMaxIdx,
long* pCaretXArray ) const
for(; (i < rVisualItem.mnEndCharPos) && (i < mnEndCharPos); ++i )
{
int j = mpLogClusters[ i ] + rVisualItem.mnMinGlyphPos;
- int nCurrIdx = i * 2;
+ int nCurrIdx = (i - mnMinCharPos) * 2;
if( !rVisualItem.IsRTL() )
{
// normal positions for LTR case
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
