From: John Emmons <emmo@us.ibm.com>
Date: Mon, 8 Aug 2011 21:00:35 +0000 (+0000)
Subject: ICU-8361 Fix array overrun in Indic layout engine
X-Git-Tag: milestone-59-0-1~4594
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=900d5370658b60aad4a610d1726dcf0f8ffa39fc;p=icu

ICU-8361 Fix array overrun in Indic layout engine

X-SVN-Rev: 30478
---

diff --git a/icu4c/source/layout/IndicReordering.cpp b/icu4c/source/layout/IndicReordering.cpp
index 8f247681c74..6f4753a8336 100644
--- a/icu4c/source/layout/IndicReordering.cpp
+++ b/icu4c/source/layout/IndicReordering.cpp
@@ -1,6 +1,6 @@
 /*
 / *
- * (C) Copyright IBM Corp. 1998-2009 - All Rights Reserved
+ * (C) Copyright IBM Corp. 1998-2011 - All Rights Reserved
  *
  */
 
@@ -241,7 +241,7 @@ public:
 					le_uint32 saveAuxData = fGlyphStorage.getAuxData(i+inv_count,success);
                     const SplitMatra *splitMatra = classTable->getSplitMatra(matraClass);
                     int j;
-                    for (j = 0 ; *(splitMatra)[j] != 0 ; j++) {
+                    for (j = 0 ; j < SM_MAX_PIECES && *(splitMatra)[j] != 0 ; j++) {
                         LEUnicode piece = (*splitMatra)[j];
 						if ( j == 0 ) {
 							fOutChars[i+inv_count] = piece;
@@ -332,7 +332,7 @@ public:
                 const SplitMatra *splitMatra = classTable->getSplitMatra(matraClass);
                 int i;
 
-                for (i = 0; i < 3 && (*splitMatra)[i] != 0; i += 1) {
+                for (i = 0; i < SM_MAX_PIECES && (*splitMatra)[i] != 0; i += 1) {
                     LEUnicode piece = (*splitMatra)[i];
                     IndicClassTable::CharClass pieceClass = classTable->getCharClass(piece);
 
diff --git a/icu4c/source/layout/IndicReordering.h b/icu4c/source/layout/IndicReordering.h
index c3452faad93..8b2fdfa5583 100644
--- a/icu4c/source/layout/IndicReordering.h
+++ b/icu4c/source/layout/IndicReordering.h
@@ -1,6 +1,6 @@
 /*
  *
- * (C) Copyright IBM Corp. 1998-2009 - All Rights Reserved
+ * (C) Copyright IBM Corp. 1998-2011 - All Rights Reserved
  *
  */
 
@@ -71,7 +71,9 @@ U_NAMESPACE_BEGIN
 #define SF_POST_BASE_LIMIT_MASK  0x0000FFFFU
 #define SF_NO_POST_BASE_LIMIT    0x00007FFFU
 
-typedef LEUnicode SplitMatra[3];
+#define SM_MAX_PIECES 3
+
+typedef LEUnicode SplitMatra[SM_MAX_PIECES];
 
 class MPreFixups;
 class LEGlyphStorage;