ICU-8361 Fix array overrun in Indic layout engine

X-SVN-Rev: 30478

diff --git a/icu4c/source/layout/IndicReordering.cpp b/icu4c/source/layout/IndicReordering.cpp
index 8f247681c74bae7a38b5894d974bc79b89f621e6..6f4753a8336773a90e17f82425776983485ba9bb 100644 (file)
--- a/icu4c/source/layout/IndicReordering.cpp
+++ b/icu4c/source/layout/IndicReordering.cpp
@@ -1,6 +1,6 @@
 /*
 / *
- * (C) Copyright IBM Corp. 1998-2009 - All Rights Reserved
+ * (C) Copyright IBM Corp. 1998-2011 - All Rights Reserved
  *
  */
 
@@ -241,7 +241,7 @@ public:
                                        le_uint32 saveAuxData = fGlyphStorage.getAuxData(i+inv_count,success);
                     const SplitMatra *splitMatra = classTable->getSplitMatra(matraClass);
                     int j;
-                    for (j = 0 ; *(splitMatra)[j] != 0 ; j++) {
+                    for (j = 0 ; j < SM_MAX_PIECES && *(splitMatra)[j] != 0 ; j++) {
                         LEUnicode piece = (*splitMatra)[j];
                                                if ( j == 0 ) {
                                                        fOutChars[i+inv_count] = piece;
@@ -332,7 +332,7 @@ public:
                 const SplitMatra *splitMatra = classTable->getSplitMatra(matraClass);
                 int i;
 
-                for (i = 0; i < 3 && (*splitMatra)[i] != 0; i += 1) {
+                for (i = 0; i < SM_MAX_PIECES && (*splitMatra)[i] != 0; i += 1) {
                     LEUnicode piece = (*splitMatra)[i];
                     IndicClassTable::CharClass pieceClass = classTable->getCharClass(piece);
 

diff --git a/icu4c/source/layout/IndicReordering.h b/icu4c/source/layout/IndicReordering.h
index c3452faad938b780f393640699d832b8856a9f14..8b2fdfa5583d362b69002f221adf5fa6483fc57a 100644 (file)
--- a/icu4c/source/layout/IndicReordering.h
+++ b/icu4c/source/layout/IndicReordering.h
@@ -1,6 +1,6 @@
 /*
  *
- * (C) Copyright IBM Corp. 1998-2009 - All Rights Reserved
+ * (C) Copyright IBM Corp. 1998-2011 - All Rights Reserved
  *
  */
 
@@ -71,7 +71,9 @@ U_NAMESPACE_BEGIN
 #define SF_POST_BASE_LIMIT_MASK  0x0000FFFFU
 #define SF_NO_POST_BASE_LIMIT    0x00007FFFU
 
-typedef LEUnicode SplitMatra[3];
+#define SM_MAX_PIECES 3
+
+typedef LEUnicode SplitMatra[SM_MAX_PIECES];
 
 class MPreFixups;
 class LEGlyphStorage;