[Libreoffice-commits] .: Branch 'libreoffice-3-5' - vcl/source

[Caolán McNamara]

 vcl/source/glyphs/graphite_layout.cxx |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit 6b7bea515ef8e762829b25b97fd84559186dd92c
Author: Michael Stahl <mstahl at redhat.com>
Date:   Fri May 25 22:43:29 2012 +0200

    fdo#50169: band-aid another crash in GraphiteLayout::expandOrCondense:
    
    error: attempt to subscript container with out-of-bounds index 6,
    but container only holds 6 elements.
    (cherry picked from commit b8452a89ceaa9008558b83f3a8b6937d14b7c803)
    
    Signed-off-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/source/glyphs/graphite_layout.cxx b/vcl/source/glyphs/graphite_layout.cxx
index 7a240bf..fd46d22 100644
--- a/vcl/source/glyphs/graphite_layout.cxx
+++ b/vcl/source/glyphs/graphite_layout.cxx
@@ -845,7 +845,11 @@ void GraphiteLayout::expandOrCondense(ImplLayoutArgs &rArgs)
                     nOffset = static_cast<int>(fExtraPerCluster * nCluster);
                     int nCharIndex = mvGlyph2Char[i];
                     assert(nCharIndex > -1);
-                    mvCharDxs[nCharIndex-mnMinCharPos] += nOffset;
+                    if (static_cast<size_t>(nCharIndex-mnMinCharPos)
+                            < mvCharDxs.size())
+                    {
+                        mvCharDxs[nCharIndex-mnMinCharPos] += nOffset;
+                    }
                     // adjust char dxs for rest of characters in cluster
                     while (++nCharIndex - mnMinCharPos < static_cast<int>(mvChar2BaseGlyph.size()))
                     {