Fix potential access beyond the array end

addNextCluster() advances position up to "end" that equals to
eng->layoutData->string.length() if current script item is the last one

Change-Id: I173286f3002c9c64dd1a89b902958699b6273d68
Reviewed-by: Jiang Jiang <jiang.jiang@nokia.com>

diff --git a/src/gui/text/qtextlayout.cpp b/src/gui/text/qtextlayout.cpp
index 43d212f..3cdd546 100644 (file)
--- a/src/gui/text/qtextlayout.cpp
+++ b/src/gui/text/qtextlayout.cpp
@@ -1865,7 +1865,9 @@ void QTextLine::layout_helper(int maxGlyphs)
                 addNextCluster(lbh.currentPosition, end, lbh.tmpData, lbh.glyphCount,
                                current, lbh.logClusters, lbh.glyphs);
 
-                if (attributes[lbh.currentPosition].whiteSpace || attributes[lbh.currentPosition-1].lineBreakType != HB_NoBreak) {
+                if (lbh.currentPosition >= eng->layoutData->string.length()
+                    || attributes[lbh.currentPosition].whiteSpace
+                    || attributes[lbh.currentPosition-1].lineBreakType != HB_NoBreak) {
                     sb_or_ws = true;
                     break;
                 } else if (breakany && attributes[lbh.currentPosition].charStop) {