[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/win

[Takeshi Abe]

 vcl/win/source/gdi/winlayout.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit e401cb5c54d7f7d6c7a24c539acf35c7ec94d75b
Author: Takeshi Abe <tabe at fixedpoint.jp>
Date:   Thu Oct 15 18:16:53 2015 +0900

    tdf#94008 Crash opening password protected file - CJK UI
    
    This fixes a buffer overflow writing over the end of pCaretXArray,
    which can happen e.g. when drawing mnemonics in the password dialog.
    Based on a similar calculation of nCurrIdx found in
    GenericSalLayout::GetCaretPositions().
    
    Change-Id: I7d723cf8cfaeb66f340c7d9ea5b3bc728c6d6209
    Reviewed-on: https://gerrit.libreoffice.org/19385
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: jan iversen <jani at documentfoundation.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit f630b6d5f165c8c507b8904b99594936edfd8da0)
    Reviewed-on: https://gerrit.libreoffice.org/20031
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/vcl/win/source/gdi/winlayout.cxx b/vcl/win/source/gdi/winlayout.cxx
index 0d733ee..abbdc5a 100644
--- a/vcl/win/source/gdi/winlayout.cxx
+++ b/vcl/win/source/gdi/winlayout.cxx
@@ -1905,7 +1905,7 @@ void UniscribeLayout::GetCaretPositions( int nMaxIdx, long* pCaretXArray ) const
         for(; (i < rVisualItem.mnEndCharPos) && (i < mnEndCharPos); ++i )
         {
             int j = mpLogClusters[ i ] + rVisualItem.mnMinGlyphPos;
-            int nCurrIdx = i * 2;
+            int nCurrIdx = (i - mnMinCharPos) * 2;
             if( !rVisualItem.IsRTL() )
             {
                 // normal positions for LTR case