[Libreoffice-commits] core.git: Branch 'distro/suse/suse-4.0' - 2 commits - tools/source vcl/win

[Herbert Dürr]

 tools/source/generic/poly.cxx    |   13 +++++++++++++
 vcl/win/source/gdi/winlayout.cxx |   17 ++++++++++++-----
 2 files changed, 25 insertions(+), 5 deletions(-)

New commits:
commit 9c340d46b457cb54700cd2e8ccaab7001ee42b27
Author: Herbert Dürr <hdu at apache.org>
Date:   Thu Mar 27 16:07:37 2014 +0000

    Related: #i124516# handle bad surrogate pairs gracefully on Windows
    
    When running into invalid Unicode surrogate pairs the text layout code on
    Windows ran into massive problems like crashes. This change detects the
    situation of an invalid surrogate pair and falls back to treat it as
    a simple character instead of requesting a complex glyph fallback.
    
    (cherry picked from commit 913f1fc4b1362f6e91595af5ae10c4cba79fd355)
    
    Change-Id: I2988f4b64061d0a5df211f6f0f04b1f235fcd6a5
    (cherry picked from commit 67688d3118b1a361d5dbdaa78e918815c163d75c)

diff --git a/vcl/win/source/gdi/winlayout.cxx b/vcl/win/source/gdi/winlayout.cxx
index 5a55387..e7bdc11 100644
--- a/vcl/win/source/gdi/winlayout.cxx
+++ b/vcl/win/source/gdi/winlayout.cxx
@@ -385,12 +385,19 @@ bool SimpleWinLayout::LayoutText( ImplLayoutArgs& rArgs )
         bool bSurrogate = ((nCharCode >= 0xD800) && (nCharCode <= 0xDFFF));
         if( bSurrogate )
         {
-            if( nCharCode >= 0xDC00 ) // this part of a surrogate pair was already processed
+            // ignore high surrogates, they were already processed with their low surrogates
+            if( nCharCode >= 0xDC00 )
                 continue;
-            nCharCode = 0x10000 + ((pCodes[0] - 0xD800) << 10) + (pCodes[1] - 0xDC00);
-    }
+            // check the second half of the surrogate pair
+            bSurrogate &= (0xDC00 <= pCodes[1]) && (pCodes[1] <= 0xDFFF);
+            // calculate the UTF-32 code of valid surrogate pairs
+            if( bSurrogate )
+                nCharCode = 0x10000 + ((pCodes[0] - 0xD800) << 10) + (pCodes[1] - 0xDC00);
+            else // or fall back to a replacement character
+                nCharCode = '?';
+        }
 
-        // get the advance width for the current UCS-4 code point
+        // get the advance width for the current UTF-32 code point
         int nGlyphWidth = mrWinFontEntry.GetCachedGlyphWidth( nCharCode );
         if( nGlyphWidth == -1 )
         {
@@ -408,7 +415,7 @@ bool SimpleWinLayout::LayoutText( ImplLayoutArgs& rArgs )
         mpGlyphAdvances[ i ] = nGlyphWidth;
         mnWidth += nGlyphWidth;
 
-        // remaining codes of surrogate pair get a zero width
+        // the second half of surrogate pair gets a zero width
         if( bSurrogate && ((i+1) < mnGlyphCount) )
             mpGlyphAdvances[ i+1 ] = 0;
 
commit 6ea4789e99c92994d083b13fd8efee8c35987561
Author: Jürgen Schmidt <jsc at apache.org>
Date:   Fri Mar 28 10:52:29 2014 +0000

    Resolves: #i124453# check if the resulting polygon...
    
    has already exceeded the number of points (2^16) that can be handled by a tools
    polygon
    
    (cherry picked from commit 804e547d70552fd64e1344d538427f8898824b43)
    
    Change-Id: I437a84493e264f7b650561599170e831da20c9aa
    (cherry picked from commit a9582c05f854cad02710178ab7fa79498573269e)
    (cherry picked from commit ab71a4512557b7290cd7b1b4923463052acf164e)

diff --git a/tools/source/generic/poly.cxx b/tools/source/generic/poly.cxx
index 585e915..6f2805b 100644
--- a/tools/source/generic/poly.cxx
+++ b/tools/source/generic/poly.cxx
@@ -910,6 +910,19 @@ void Polygon::AdaptiveSubdivide( Polygon& rResult, const double d ) const
             }
 
             *aPointIter++ = mpImplPolygon->mpPointAry[ i++ ];
+
+            if (aPoints.size() >= SAL_MAX_UINT16)
+            {
+                OSL_ENSURE(aPoints.size() < SAL_MAX_UINT16,
+                    "Polygon::AdapativeSubdivision created polygon too many points;"
+                    " using original polygon instead");
+
+                // The resulting polygon can not hold all the points
+                // that we have created so far.  Stop the subdivision
+                // and return a copy of the unmodified polygon.
+                rResult = *this;
+                return;
+            }
         }
 
         // fill result polygon