| commit | 7763a6a02fcd4479111530b64b9f6e00899aad2d | [log] [tgz] |
|---|---|---|
| author | bashi@chromium.org <bashi@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | Fri Jul 29 01:58:29 2011 |
| committer | bashi@chromium.org <bashi@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | Fri Jul 29 01:58:29 2011 |
| tree | dc86148b6394239c2085d99430a48f369deb4706 | |
| parent | ea41e2bcaff5770690f7d7033fbf1079c44a770d [diff] |
OOB read in harfbuzz with khmer character. Sets face->tmpLogClusters[i] to the last valid value of |item->log_clusters| when |i| exceeds the size of the |item->log_clusters|. BUG=90134 TEST=checked with ASAN and ran webkit/tools/layout_tests/run_webkit_tests.sh Review URL: http://codereview.chromium.org/7465036 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@94616 0039d316-1c4b-4281-b951-d872f2087c98