OOB read in harfbuzz with khmer character.

third_party/harfbuzz/src/harfbuzz-shaper.cpp

Index: third_party/harfbuzz/src/harfbuzz-shaper.cpp
diff --git a/third_party/harfbuzz/src/harfbuzz-shaper.cpp b/third_party/harfbuzz/src/harfbuzz-shaper.cpp
index f1606e6a79813f5214248f76da56f2050b08d60b..2a91b076bb3d949cff466b2fc15ad108505bd50d 100644
--- a/third_party/harfbuzz/src/harfbuzz-shaper.cpp
+++ b/third_party/harfbuzz/src/harfbuzz-shaper.cpp
@@ -1150,10 +1150,11 @@ HB_Bool HB_OpenTypeShape(HB_ShaperItem *item, const hb_uint32 *properties)
         return false;
     face->tmpLogClusters = tmpLogClusters;
 
+    const int itemLength = item->item.length;
     for (int i = 0; i < face->length; ++i) {
         hb_buffer_add_glyph(face->buffer, item->glyphs[i], properties ? properties[i] : 0, i);
         face->tmpAttributes[i] = item->attributes[i];
-        face->tmpLogClusters[i] = item->log_clusters[i];
+        face->tmpLogClusters[i] = i < itemLength ? item->log_clusters[i] : item->log_clusters[itemLength - 1];

[agl, 2011/07/26 14:21:38]

What happens if |itemLength| is zero? Is this impossible?

[bashi, 2011/07/27 03:24:01]

I think |itemLength| is always greater than zero. Added an assertion just in
case.

     }
 
 #ifdef OT_DEBUG