OOB read in harfbuzz with khmer character.

third_party/harfbuzz/src/harfbuzz-shaper.cpp

 /*
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This is part of HarfBuzz, an OpenType Layout engine library.
  *
  * Permission is hereby granted, without written agreement and without
  * license or royalty fees, to use, copy, modify, and distribute this
  * software and its documentation for any purpose, provided that the
  * above copyright notice and the following two paragraphs appear in
  * all copies of this software.
@@ skipping 1132 matching lines @@
     tmpAttributes = (HB_GlyphAttributes *) realloc(face->tmpAttributes, face->length*sizeof(HB_GlyphAttributes));
     if (!tmpAttributes)
         return false;
     face->tmpAttributes = tmpAttributes;
 
     tmpLogClusters = (unsigned int *) realloc(face->tmpLogClusters, face->length*sizeof(unsigned int));
     if (!tmpLogClusters)
         return false;
     face->tmpLogClusters = tmpLogClusters;
 
+    const int itemLength = item->item.length;
     for (int i = 0; i < face->length; ++i) {
         hb_buffer_add_glyph(face->buffer, item->glyphs[i], properties ? properties[i] : 0, i);
         face->tmpAttributes[i] = item->attributes[i];
-        face->tmpLogClusters[i] = item->log_clusters[i];
+        face->tmpLogClusters[i] = i < itemLength ? item->log_clusters[i] : item->log_clusters[itemLength - 1];

[agl, 2011/07/26 14:21:38]

What happens if |itemLength| is zero? Is this impossible?

[bashi, 2011/07/27 03:24:01]

I think |itemLength| is always greater than zero. Added an assertion just in
case.

     }
 
 #ifdef OT_DEBUG
     DEBUG("-----------------------------------------");
 //     DEBUG("log clusters before shaping:");
 //     for (int j = 0; j < length; j++)
 //         DEBUG("    log[%d] = %d", j, item->log_clusters[j]);
     DEBUG("original glyphs: %p", item->glyphs);
     for (int i = 0; i < length; ++i)
         DEBUG("   glyph=%4x", hb_buffer->in_string[i].gindex);
@@ skipping 181 matching lines @@
     if (shaper_item->num_glyphs < shaper_item->item.length) {
         shaper_item->num_glyphs = shaper_item->item.length;
         return false;
     }
     assert(shaper_item->item.script < HB_ScriptCount);
     result = HB_ScriptEngines[shaper_item->item.script].shape(shaper_item);
     shaper_item->glyphIndicesPresent = false;
     return result;
 }