From 3ff0ac77ad73b4b951befbb18be28e43f383adf4 Mon Sep 17 00:00:00 2001
From: "Steven R. Loomis" <srl@icu-project.org>
Date: Thu, 17 Dec 2015 01:36:04 +0000
Subject: [PATCH] ICU-10684 merge in Layout updates

Upstream: http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/9d29c19f1de1

X-SVN-Rev: 38142
---
 icu4c/source/layout/LookupProcessor.cpp | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/icu4c/source/layout/LookupProcessor.cpp b/icu4c/source/layout/LookupProcessor.cpp
index 43b8e44cd5..5831e644ea 100644
--- a/icu4c/source/layout/LookupProcessor.cpp
+++ b/icu4c/source/layout/LookupProcessor.cpp
@@ -1,6 +1,6 @@
 /*
  *
- * (C) Copyright IBM Corp. and others 1998-2013 - All Rights Reserved
+ * (C) Copyright IBM Corp. and others 1998-2015 - All Rights Reserved
  *
  */
 
@@ -113,7 +113,7 @@ le_uint32 LookupProcessor::applySingleLookup(le_uint16 lookupTableIndex, GlyphIt
 le_int32 LookupProcessor::selectLookups(const LEReferenceTo<FeatureTable> &featureTable, FeatureMask featureMask, le_int32 order, LEErrorCode &success)
 {
   le_uint16 lookupCount = featureTable.isValid()? SWAPW(featureTable->lookupCount) : 0;
-    le_int32  store = order;
+  le_int32  store = (le_uint32)order;
     
     LEReferenceToArrayOf<le_uint16> lookupListIndexArray(featureTable, success, featureTable->lookupListIndexArray, lookupCount);
 
@@ -122,6 +122,9 @@ le_int32 LookupProcessor::selectLookups(const LEReferenceTo<FeatureTable> &featu
       if (lookupListIndex >= lookupSelectCount) {
         continue;
       }
+      if (store >= lookupOrderCount) {
+        continue;
+      }
       
       lookupSelectArray[lookupListIndex] |= featureMask;
       lookupOrderArray[store++] = lookupListIndex;
@@ -220,7 +223,7 @@ LookupProcessor::LookupProcessor(const LETableReference &baseAddress,
 
     if (requiredFeatureIndex != 0xFFFF) {
       requiredFeatureTable = featureListTable->getFeatureTable(featureListTable, requiredFeatureIndex, &requiredFeatureTag, success);
-      featureReferences += SWAPW(featureTable->lookupCount);
+      featureReferences += SWAPW(requiredFeatureTable->lookupCount);
     }
 
     lookupOrderArray = LE_NEW_ARRAY(le_uint16, featureReferences);
@@ -228,6 +231,7 @@ LookupProcessor::LookupProcessor(const LETableReference &baseAddress,
         success = LE_MEMORY_ALLOCATION_ERROR;
         return;
     }
+    lookupOrderCount = featureReferences;
 
     for (le_int32 f = 0; f < featureMapCount; f += 1) {
         FeatureMap fm = featureMap[f];