From: huayong.xu <huayong.xu@samsung.com>
Date: Tue, 14 Mar 2023 06:01:42 +0000 (+0800)
Subject: Fix heap-buffer-overflow & use-after-free issue.
X-Git-Tag: dali_2.2.19~13^2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=7900d55362fe0375982f4a3e5dff369135774a2d;p=platform%2Fcore%2Fuifw%2Fdali-toolkit.git

Fix heap-buffer-overflow & use-after-free issue.

Change-Id: Ic3ca8eba0eb795566159aa6ab105ae5a58c4ec61
---

diff --git a/automated-tests/src/dali-scene3d-internal/utc-Dali-DliLoaderImpl.cpp b/automated-tests/src/dali-scene3d-internal/utc-Dali-DliLoaderImpl.cpp
index 0610deb..e23616e 100644
--- a/automated-tests/src/dali-scene3d-internal/utc-Dali-DliLoaderImpl.cpp
+++ b/automated-tests/src/dali-scene3d-internal/utc-Dali-DliLoaderImpl.cpp
@@ -182,6 +182,7 @@ int UtcDaliDliLoaderLoadSceneAssertions(void)
 
 int UtcDaliDliLoaderLoadSceneExercise(void)
 {
+  TestApplication app;
   Context ctx;
 
   auto path = ctx.pathProvider(ResourceType::Mesh) + "exercise.dli";
@@ -219,8 +220,6 @@ int UtcDaliDliLoaderLoadSceneExercise(void)
 
   Customization::Choices choices;
 
-  TestApplication app;
-
   Actor root = Actor::New();
   SetActorCentered(root);
   for(auto iRoot : scene.GetRoots())
diff --git a/automated-tests/src/dali-scene3d-internal/utc-Dali-Gltf2LoaderImpl.cpp b/automated-tests/src/dali-scene3d-internal/utc-Dali-Gltf2LoaderImpl.cpp
index b305a41..03d2f97 100644
--- a/automated-tests/src/dali-scene3d-internal/utc-Dali-Gltf2LoaderImpl.cpp
+++ b/automated-tests/src/dali-scene3d-internal/utc-Dali-Gltf2LoaderImpl.cpp
@@ -631,6 +631,7 @@ int UtcDaliGltfLoaderMRendererTest(void)
 
 int UtcDaliGltfLoaderAnimationLoadingTest(void)
 {
+  TestApplication app;
   Context ctx;
 
   auto& resources = ctx.resources;
@@ -652,8 +653,6 @@ int UtcDaliGltfLoaderAnimationLoadingTest(void)
 
   Customization::Choices choices;
 
-  TestApplication app;
-
   Actor root = Actor::New();
   SetActorCentered(root);
   for(auto iRoot : roots)
diff --git a/automated-tests/src/dali-toolkit/dali-toolkit-test-utils/test-graphics-controller.cpp b/automated-tests/src/dali-toolkit/dali-toolkit-test-utils/test-graphics-controller.cpp
index 04d193c..319ec67 100644
--- a/automated-tests/src/dali-toolkit/dali-toolkit-test-utils/test-graphics-controller.cpp
+++ b/automated-tests/src/dali-toolkit/dali-toolkit-test-utils/test-graphics-controller.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022 Samsung Electronics Co., Ltd.
+ * Copyright (c) 2023 Samsung Electronics Co., Ltd.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -1214,7 +1214,7 @@ Graphics::UniquePtr<Graphics::Program> TestGraphicsController::CreateProgram(con
       source.resize(graphicsShader->mCreateInfo.sourceSize);
       memcpy(&source[0], graphicsShader->mCreateInfo.sourceData, graphicsShader->mCreateInfo.sourceSize);
 
-      if(!std::equal(source.begin(), source.end(), cacheEntry.shaders[shader.pipelineStage].begin()))
+      if(!std::equal(source.begin(), source.end(), cacheEntry.shaders[shader.pipelineStage].begin(), cacheEntry.shaders[shader.pipelineStage].end()))
       {
         found = false;
         break;
diff --git a/dali-toolkit/internal/text/text-view.cpp b/dali-toolkit/internal/text/text-view.cpp
index 334d922..469a318 100644
--- a/dali-toolkit/internal/text/text-view.cpp
+++ b/dali-toolkit/internal/text/text-view.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022 Samsung Electronics Co., Ltd.
+ * Copyright (c) 2023 Samsung Electronics Co., Ltd.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -549,6 +549,12 @@ Length View::GetGlyphs(GlyphInfo* glyphs,
             {
               Length numberOfSecondHalfGlyphs = numberOfLaidOutGlyphs - firstMiddleIndexOfElidedGlyphs + 1u;
 
+              // Make sure that out-of-boundary does not occur.
+              if(secondMiddleIndexOfElidedGlyphs + numberOfSecondHalfGlyphs > numberOfGlyphs)
+              {
+                numberOfSecondHalfGlyphs = numberOfGlyphs - secondMiddleIndexOfElidedGlyphs;
+              }
+
               //Copy elided glyphs after the ellipsis glyph.
               memcpy(glyphs + firstMiddleIndexOfElidedGlyphs + 1u, glyphs + secondMiddleIndexOfElidedGlyphs, numberOfSecondHalfGlyphs * sizeof(GlyphInfo));
               memcpy(glyphPositions + firstMiddleIndexOfElidedGlyphs + 1u, glyphPositions + secondMiddleIndexOfElidedGlyphs, numberOfSecondHalfGlyphs * sizeof(Vector2));