AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

QFontEngine: Do not call getSfntTable with uninitalized value

Browse Source 
On FreeType font engine this results in a call to FT_Load_Sfnt_Table
with a pointer to an uninitialized value passed in as FT_ULong* length,
crashing. Instead initialize value to 0.

Change-Id: I50d6df3b2296a05640d939e862bc50adb0fec921
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
(cherry picked from commit e041f54596)
This commit is contained in:
Christoph Schleifenbaum 2020-09-24 07:14:48 +02:00
parent dae078e521
commit 34b4dc11d9
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/gui/text/qfontengine.cpp
View File

@ -229,8 +229,8 @@ bool QFontEngine::supportsScript(QChar::Script script) const
#if QT_CONFIG(harfbuzz) #if QT_CONFIG(harfbuzz)
if (qt_useHarfbuzzNG()) { if (qt_useHarfbuzzNG()) {
// in AAT fonts, 'gsub' table is effectively replaced by 'mort'/'morx' table // in AAT fonts, 'gsub' table is effectively replaced by 'mort'/'morx' table
uint len; uint lenMort = 0, lenMorx = 0;
if (getSfntTableData(MAKE_TAG('m','o','r','t'), nullptr, &len) || getSfntTableData(MAKE_TAG('m','o','r','x'), nullptr, &len)) if (getSfntTableData(MAKE_TAG('m','o','r','t'), nullptr, &lenMort) || getSfntTableData(MAKE_TAG('m','o','r','x'), nullptr, &lenMorx))
return true; return true;
if (hb_face_t *face = hb_qt_face_get_for_engine(const_cast<QFontEngine *>(this))) { if (hb_face_t *face = hb_qt_face_get_for_engine(const_cast<QFontEngine *>(this))) {