Roll HarfBuzz to 1.3.4

third_party/harfbuzz-ng/src/hb-open-type-private.hh

 /*
  * Copyright © 2007,2008,2009,2010  Red Hat, Inc.
  * Copyright © 2012  Google, Inc.
  *
  *  This is part of HarfBuzz, a text shaping library.
  *
  * Permission is hereby granted, without written agreement and without
  * license or royalty fees, to use, copy, modify, and distribute this
  * software and its documentation for any purpose, provided that the
  * above copyright notice and the following two paragraphs appear in
@@ skipping 632 matching lines @@
   {
     TRACE_SANITIZE (this);
     return_trace (likely (c->check_struct (this)));
   }
   protected:
   BEInt<Type, Size> v;
   public:
   DEFINE_SIZE_STATIC (Size);
 };
 
+typedef IntType<int8_t  , 1> CHAR;      /* 8-bit signed integer. */
 typedef IntType<uint8_t , 1> BYTE;      /* 8-bit unsigned integer. */
 typedef IntType<uint16_t, 2> USHORT;    /* 16-bit unsigned integer. */
 typedef IntType<int16_t,  2> SHORT;     /* 16-bit signed integer. */
 typedef IntType<uint32_t, 4> ULONG;     /* 32-bit unsigned integer. */
 typedef IntType<int32_t,  4> LONG;      /* 32-bit signed integer. */
 typedef IntType<uint32_t, 3> UINT24;    /* 24-bit unsigned integer. */
 
 /* 16-bit signed integer (SHORT) that describes a quantity in FUnits. */
 typedef SHORT FWORD;
 
@@ skipping 135 matching lines @@
     this->set ((char *) t - (char *) base); /* TODO(serialize) Overflow? */
     return *t;
   }
 
   inline bool sanitize (hb_sanitize_context_t *c, const void *base) const
   {
     TRACE_SANITIZE (this);
     if (unlikely (!c->check_struct (this))) return_trace (false);
     unsigned int offset = *this;
     if (unlikely (!offset)) return_trace (true);
+    if (unlikely (!c->check_range (base, offset))) return_trace (false);
     const Type &obj = StructAtOffset<Type> (base, offset);
     return_trace (likely (obj.sanitize (c)) || neuter (c));
   }
   template <typename T>
   inline bool sanitize (hb_sanitize_context_t *c, const void *base, T user_data) const
   {
     TRACE_SANITIZE (this);
     if (unlikely (!c->check_struct (this))) return_trace (false);
     unsigned int offset = *this;
     if (unlikely (!offset)) return_trace (true);
+    if (unlikely (!c->check_range (base, offset))) return_trace (false);
     const Type &obj = StructAtOffset<Type> (base, offset);
     return_trace (likely (obj.sanitize (c, user_data)) || neuter (c));
   }
 
   /* Set the offset to Null */
   inline bool neuter (hb_sanitize_context_t *c) const {
     return c->try_set (this, 0);
   }
   DEFINE_SIZE_STATIC (sizeof(OffsetType));
 };
@@ skipping 226 matching lines @@
     }
     return -1;
   }
 };
 
 
 } /* namespace OT */
 
 
 #endif /* HB_OPEN_TYPE_PRIVATE_HH */