[core] Fix crash in text primitive occurring under certain circumstances.

c-lipka · c-lipka · commit f9e8bce27b3d · 2019-01-13T22:57:16.000+01:00
diff --git a/source/core/shape/truetype.cpp b/source/core/shape/truetype.cpp
@@ -1657,7 +1657,7 @@ bool ProcessFormat4Glyph(TrueTypeFont *ffile, GlyphIndex& glyphIndex, int cmapId
 
                 if (cmap4Info->idRangeOffset[i] == 0)
                 {
-                    glyphIndex = search_codepoint + cmap4Info->idDelta[i];
+                    glyphIndex = (search_codepoint + cmap4Info->idDelta[i]) & 0xFFFF;
                 }
                 else
                 {
@@ -1674,7 +1674,7 @@ bool ProcessFormat4Glyph(TrueTypeFont *ffile, GlyphIndex& glyphIndex, int cmapId
                     glyphIndex = READUSHORT(*ffile->file);
 
                     if (glyphIndex != 0)
-                        glyphIndex += cmap4Info->idDelta[i];
+                        glyphIndex = (glyphIndex + cmap4Info->idDelta[i]) & 0xFFFF;
                 }
             }
             break;

Original file line number	Diff line number	Diff line change
`@@ -1657,7 +1657,7 @@ bool ProcessFormat4Glyph(TrueTypeFont *ffile, GlyphIndex& glyphIndex, int cmapId`
`1657`	`1657`
`1658`	`1658`	`if (cmap4Info->idRangeOffset[i] == 0)`
`1659`	`1659`	`{`
`1660`		`- glyphIndex = search_codepoint + cmap4Info->idDelta[i];`
	`1660`	`+ glyphIndex = (search_codepoint + cmap4Info->idDelta[i]) & 0xFFFF;`
`1661`	`1661`	`}`
`1662`	`1662`	`else`
`1663`	`1663`	`{`
`@@ -1674,7 +1674,7 @@ bool ProcessFormat4Glyph(TrueTypeFont *ffile, GlyphIndex& glyphIndex, int cmapId`
`1674`	`1674`	`glyphIndex = READUSHORT(*ffile->file);`
`1675`	`1675`
`1676`	`1676`	`if (glyphIndex != 0)`
`1677`		`- glyphIndex += cmap4Info->idDelta[i];`
	`1677`	`+ glyphIndex = (glyphIndex + cmap4Info->idDelta[i]) & 0xFFFF;`
`1678`	`1678`	`}`
`1679`	`1679`	`}`
`1680`	`1680`	`break;`