From: Behdad Esfahbod <behdad@behdad.org>
Date: Mon, 18 May 2009 10:00:12 +0000 (-0400)
Subject: [GSUB] Protect against mismatching Extension subtable types
X-Git-Tag: 1.25.1~189
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=cda2b36b75bd7be71d830bee78b2ab5845e90831;p=platform%2Fupstream%2Fpango.git

[GSUB] Protect against mismatching Extension subtable types
---

diff --git a/pango/opentype/hb-ot-layout-gsub-private.h b/pango/opentype/hb-ot-layout-gsub-private.h
index da31a70..dc28df6 100644
--- a/pango/opentype/hb-ot-layout-gsub-private.h
+++ b/pango/opentype/hb-ot-layout-gsub-private.h
@@ -679,10 +679,13 @@ struct SubstLookup : Lookup {
     unsigned int type = get_type ();
 
     if (HB_UNLIKELY (type == GSUB_Extension)) {
-      /* Return lookup type of first extension subtable.
-       * The spec says all of them should have the same type.
-       * XXX check for that in sanitize() */
+      unsigned int count = get_subtable_count ();
       type = get_subtable(0).u.extension->get_type ();
+      /* The spec says all subtables should have the same type.
+       * This is specially important if one has a reverse type! */
+      for (unsigned int i = 1; i < count; i++)
+        if (get_subtable(i).u.extension->get_type () != type)
+	  return 0;
     }
 
     return type;