[PATCH 0/1] MR7062: dwrite: Avoid stack-buffer-overflow in arabic_setup_masks.

[Nikolay Sivov (＠nsivov)]

Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com>

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/7062

[PATCH 1/1] dwrite: Avoid stack-buffer-overflow in arabic_setup_masks.

[Bernhard Übelacker]

From: Bernhard Übelacker <bernhardu(a)mailbox.org>

Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com>
---
 dlls/dwrite/shapers/arabic.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dlls/dwrite/shapers/arabic.c b/dlls/dwrite/shapers/arabic.c
index 92e888d0bd9..57ef287a3df 100644
--- a/dlls/dwrite/shapers/arabic.c
+++ b/dlls/dwrite/shapers/arabic.c
@@ -144,7 +144,7 @@ static void arabic_setup_masks(struct scriptshaping_context *context,
         const struct shaping_features *features)
 {
     unsigned int i, prev = ~0u, state = 0;
-    unsigned int masks[NUM_FEATURES];
+    unsigned int masks[NUM_FEATURES+1];
 
     for (i = 0; i < context->glyph_count; ++i)
     {
@@ -168,8 +168,9 @@ static void arabic_setup_masks(struct scriptshaping_context *context,
         state = entry->next_state;
     }
 
-    for (i = 0; i < ARRAY_SIZE(masks); ++i)
+    for (i = 0; i < NUM_FEATURES; ++i)
         masks[i] = shape_get_feature_1_mask(features, arabic_features[i]);
+    masks[NONE] = 0;
 
     /* Unaffected glyphs get action NONE with zero mask. */
     for (i = 0; i < context->glyph_count; ++i)
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/7062

[PATCH 0/1] MR7062: dwrite: Avoid stack-buffer-overflow in arabic_setup_masks. - approved

[Nikolay Sivov (＠nsivov)]

This merge request was approved by Nikolay Sivov.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/7062