summaryrefslogtreecommitdiffstats
path: root/icu.rhbz1074549.CVE-2013-5907.patch
diff options
context:
space:
mode:
authorRemi Collet <fedora@famillecollet.com>2014-11-25 18:55:12 +0100
committerRemi Collet <fedora@famillecollet.com>2014-11-25 18:55:12 +0100
commitf555c3b2effa24a1dfc5a76fec146bf987ee8ed0 (patch)
tree2ee0aa72505ab482682cb17028e15fa8fbdcb4b3 /icu.rhbz1074549.CVE-2013-5907.patch
parent6f7921581bc6c69ca79112d93f5eb666a21c6ecb (diff)
icu-last: 5.1.2-11 (backport changes, but still FTBFS)
Diffstat (limited to 'icu.rhbz1074549.CVE-2013-5907.patch')
-rw-r--r--icu.rhbz1074549.CVE-2013-5907.patch37
1 files changed, 37 insertions, 0 deletions
diff --git a/icu.rhbz1074549.CVE-2013-5907.patch b/icu.rhbz1074549.CVE-2013-5907.patch
new file mode 100644
index 0000000..beb22b3
--- /dev/null
+++ b/icu.rhbz1074549.CVE-2013-5907.patch
@@ -0,0 +1,37 @@
+
+# erAck: resolves https://bugzilla.redhat.com/show_bug.cgi?id=1074549
+# Based on http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/9d29c19f1de1
+# where a/src/share/native/sun/font/layout/LookupProcessor.cpp is
+# icu/source/layout/LookupProcessor.cpp
+# Adapted to LayoutEngine "patch" and subsequent patches.
+# Note that
+#@@ -246,7 +249,7 @@
+#- featureReferences += SWAPW(featureTable->lookupCount);
+#+ featureReferences += SWAPW(requiredFeatureTable->lookupCount);
+# was already applied with icu.8800.freeserif.crash.patch that also added
+#+ if (requiredFeatureTable.isValid()) {
+# and is a slightly enhanced version of
+# https://ssl.icu-project.org/trac/ticket/8800 and/or
+# https://ssl.icu-project.org/trac/ticket/8320
+
+--- prev.icu/source/layout/LookupProcessor.cpp 2014-03-11 20:46:53.288819882 +0100
++++ icu/source/layout/LookupProcessor.cpp 2014-03-11 20:54:43.153370234 +0100
+@@ -113,7 +113,7 @@
+ le_int32 LookupProcessor::selectLookups(const LEReferenceTo<FeatureTable> &featureTable, FeatureMask featureMask, le_int32 order, LEErrorCode &success)
+ {
+ le_uint16 lookupCount = featureTable.isValid()? SWAPW(featureTable->lookupCount) : 0;
+- le_int32 store = order;
++ le_uint32 store = (le_uint32)order;
+
+ LEReferenceToArrayOf<le_uint16> lookupListIndexArray(featureTable, success, featureTable->lookupListIndexArray, lookupCount);
+
+@@ -122,6 +122,9 @@
+ if (lookupListIndex >= lookupSelectCount) {
+ continue;
+ }
++ if (store >= lookupOrderCount) {
++ continue;
++ }
+
+ lookupSelectArray[lookupListIndex] |= featureMask;
+ lookupOrderArray[store++] = lookupListIndex;