[HarfBuzz] harfbuzz: Branch 'master' - 2 commits

[Behdad Esfahbod]

 src/hb-aat-layout-kerx-table.hh |   56 ++++++++++++++++------------------------
 1 file changed, 23 insertions(+), 33 deletions(-)

New commits:
commit 6d4b054234b4736ca9927268ee3e2d9a0f8f6ead
Author: Behdad Esfahbod <behdad at behdad.org>
Date:   Sat Oct 13 12:20:33 2018 -0400

    [kerx] Use sanitizer instead of handcoded runtime sanitization

diff --git a/src/hb-aat-layout-kerx-table.hh b/src/hb-aat-layout-kerx-table.hh
index 2004e579..d65f3093 100644
--- a/src/hb-aat-layout-kerx-table.hh
+++ b/src/hb-aat-layout-kerx-table.hh
@@ -232,11 +232,9 @@ struct KerxSubTableFormat2
     unsigned int l = (this+leftClassTable).get_value_or_null (left, num_glyphs);
     unsigned int r = (this+rightClassTable).get_value_or_null (right, num_glyphs);
     unsigned int offset = l + r;
-    const FWORD *v = &StructAtOffset<FWORD> (&(this+array), offset);
-    if (unlikely ((const char *) v < (const char *) &array ||
-		  (const char *) v - (const char *) this > header.length - v->static_size))
-      return 0;
-    return *v;
+    const FWORD v = StructAtOffset<FWORD> (&(this+array), offset);
+    if (unlikely (!v.sanitize (&c->sanitizer))) return 0;
+    return v;
   }
 
   inline bool apply (hb_aat_apply_context_t *c) const
@@ -481,11 +479,9 @@ struct KerxSubTableFormat6
       unsigned int offset = l + r;
       if (unlikely (offset < l)) return 0; /* Addition overflow. */
       if (unlikely (hb_unsigned_mul_overflows (offset, sizeof (FWORD32)))) return 0;
-      const FWORD32 *v = &StructAtOffset<FWORD32> (&(this+t.array), offset * sizeof (FWORD32));
-      if (unlikely ((const char *) v < (const char *) &t.array ||
-		    (const char *) v - (const char *) this > header.length - v->static_size))
-	return 0;
-      return *v;
+      const FWORD32 &v = StructAtOffset<FWORD32> (&(this+t.array), offset * sizeof (FWORD32));
+      if (unlikely (!v.sanitize (&c->sanitizer))) return 0;
+      return v;
     }
     else
     {
@@ -493,11 +489,9 @@ struct KerxSubTableFormat6
       unsigned int l = (this+t.rowIndexTable).get_value_or_null (left, num_glyphs);
       unsigned int r = (this+t.columnIndexTable).get_value_or_null (right, num_glyphs);
       unsigned int offset = l + r;
-      const FWORD *v = &StructAtOffset<FWORD> (&(this+t.array), offset * sizeof (FWORD));
-      if (unlikely ((const char *) v < (const char *) &t.array ||
-		    (const char *) v - (const char *) this > header.length - v->static_size))
-	return 0;
-      return *v;
+      const FWORD &v = StructAtOffset<FWORD> (&(this+t.array), offset * sizeof (FWORD));
+      if (unlikely (!v.sanitize (&c->sanitizer))) return 0;
+      return v;
     }
   }
 
commit 5733113662e668a25187e0042935d955e44fb488
Author: Behdad Esfahbod <behdad at behdad.org>
Date:   Sat Oct 13 12:16:12 2018 -0400

    [kerx] Wire up context down to get_kerning

diff --git a/src/hb-aat-layout-kerx-table.hh b/src/hb-aat-layout-kerx-table.hh
index d59d6374..2004e579 100644
--- a/src/hb-aat-layout-kerx-table.hh
+++ b/src/hb-aat-layout-kerx-table.hh
@@ -226,8 +226,9 @@ struct KerxSubTableFormat1
 struct KerxSubTableFormat2
 {
   inline int get_kerning (hb_codepoint_t left, hb_codepoint_t right,
-			  unsigned int num_glyphs) const
+			  hb_aat_apply_context_t *c) const
   {
+    unsigned int num_glyphs = c->sanitizer.get_num_glyphs ();
     unsigned int l = (this+leftClassTable).get_value_or_null (left, num_glyphs);
     unsigned int r = (this+rightClassTable).get_value_or_null (right, num_glyphs);
     unsigned int offset = l + r;
@@ -245,8 +246,7 @@ struct KerxSubTableFormat2
     if (!c->plan->requested_kerning)
       return false;
 
-    accelerator_t accel (*this,
-			 c->sanitizer.get_num_glyphs ());
+    accelerator_t accel (*this, c);
     hb_kern_machine_t<accelerator_t> machine (accel);
     machine.kern (c->font, c->buffer, c->plan->kern_mask);
 
@@ -264,16 +264,14 @@ struct KerxSubTableFormat2
   struct accelerator_t
   {
     const KerxSubTableFormat2 &table;
-    unsigned int num_glyphs;
+    hb_aat_apply_context_t *c;
 
     inline accelerator_t (const KerxSubTableFormat2 &table_,
-			  unsigned int num_glyphs_)
-			  : table (table_), num_glyphs (num_glyphs_) {}
+			  hb_aat_apply_context_t *c_) :
+			    table (table_), c (c_) {}
 
     inline int get_kerning (hb_codepoint_t left, hb_codepoint_t right) const
-    {
-      return table.get_kerning (left, right, num_glyphs);
-    }
+    { return table.get_kerning (left, right, c); }
   };
 
   protected:
@@ -472,8 +470,9 @@ struct KerxSubTableFormat6
   inline bool is_long (void) const { return flags & ValuesAreLong; }
 
   inline int get_kerning (hb_codepoint_t left, hb_codepoint_t right,
-			  unsigned int num_glyphs) const
+			  hb_aat_apply_context_t *c) const
   {
+    unsigned int num_glyphs = c->sanitizer.get_num_glyphs ();
     if (is_long ())
     {
       const U::Long &t = u.l;
@@ -509,8 +508,7 @@ struct KerxSubTableFormat6
     if (!c->plan->requested_kerning)
       return false;
 
-    accelerator_t accel (*this,
-			 c->sanitizer.get_num_glyphs ());
+    accelerator_t accel (*this, c);
     hb_kern_machine_t<accelerator_t> machine (accel);
     machine.kern (c->font, c->buffer, c->plan->kern_mask);
 
@@ -534,16 +532,14 @@ struct KerxSubTableFormat6
   struct accelerator_t
   {
     const KerxSubTableFormat6 &table;
-    unsigned int num_glyphs;
+    hb_aat_apply_context_t *c;
 
     inline accelerator_t (const KerxSubTableFormat6 &table_,
-			  unsigned int num_glyphs_)
-			  : table (table_), num_glyphs (num_glyphs_) {}
+			  hb_aat_apply_context_t *c_) :
+			    table (table_), c (c_) {}
 
     inline int get_kerning (hb_codepoint_t left, hb_codepoint_t right) const
-    {
-      return table.get_kerning (left, right, num_glyphs);
-    }
+    { return table.get_kerning (left, right, c); }
   };
 
   protected: