X-Git-Url: https://git.saurik.com/apple/icu.git/blobdiff_plain/57a6839dcb3bba09e8228b822b290604668416fe..2ca993e82fb37b597a3c73ecd1586a139a6579c5:/icuSources/layout/LETableReference.h

diff --git a/icuSources/layout/LETableReference.h b/icuSources/layout/LETableReference.h
index f7eb79b2..ccbe65db 100644
--- a/icuSources/layout/LETableReference.h
+++ b/icuSources/layout/LETableReference.h
@@ -1,7 +1,7 @@
 /*
  * -*- c++ -*-
  *
- * (C) Copyright IBM Corp. and others 2013 - All Rights Reserved
+ * (C) Copyright IBM Corp. and others 2015 - All Rights Reserved
  *
  * Range checking
  *
@@ -179,6 +179,18 @@ public:
     return fLength;
   }
 
+  /**
+  * Throw an error if size*count overflows
+  */
+  size_t verifyLength(size_t offset, size_t size, le_uint32 count, LEErrorCode &success) {
+    if(count!=0 && size>LE_UINT32_MAX/count) {
+      LE_DEBUG_TR3("verifyLength failed size=%u, count=%u", size, count);
+      success = LE_INDEX_OUT_OF_BOUNDS_ERROR;
+      return 0;
+    }
+    return verifyLength(offset, size*count, success);
+  }
+
   /**
    * Change parent link to another
    */
@@ -269,7 +281,7 @@ public:
       if(count == LE_UNBOUNDED_ARRAY) { // not a known length
         count = getLength()/LETableVarSizer<T>::getSize(); // fit to max size
       }
-      LETableReference::verifyLength(0, LETableVarSizer<T>::getSize()*count, success);
+      LETableReference::verifyLength(0, LETableVarSizer<T>::getSize(), fCount, success);
     }
     if(LE_FAILURE(success)) {
       fCount=0;
@@ -284,7 +296,7 @@ LE_TRACE_TR("INFO: new RTAO")
       if(count == LE_UNBOUNDED_ARRAY) { // not a known length
         count = getLength()/LETableVarSizer<T>::getSize(); // fit to max size
       }
-      LETableReference::verifyLength(0, LETableVarSizer<T>::getSize()*count, success);
+      LETableReference::verifyLength(0, LETableVarSizer<T>::getSize(), fCount, success);
     }
     if(LE_FAILURE(success)) clear();
   }
@@ -295,7 +307,7 @@ LE_TRACE_TR("INFO: new RTAO")
       if(count == LE_UNBOUNDED_ARRAY) { // not a known length
         count = getLength()/LETableVarSizer<T>::getSize(); // fit to max size
       }
-      LETableReference::verifyLength(0, LETableVarSizer<T>::getSize()*count, success);
+      LETableReference::verifyLength(0, LETableVarSizer<T>::getSize(), fCount, success);
     }
     if(LE_FAILURE(success)) clear();
   }
@@ -313,7 +325,12 @@ LE_TRACE_TR("INFO: new RTAO")
   const T *getAliasRAW() const { LE_DEBUG_TR("getAliasRAW<>"); return (const T*)fStart; }
 
   const T& getObject(le_uint32 i, LEErrorCode &success) const {
-    return *getAlias(i,success);
+      const T *ret = getAlias(i, success);
+      if (LE_FAILURE(success) || ret==NULL) {
+          return *(new T(0));
+      } else {
+          return *ret;
+     }
   }
   
   const T& operator()(le_uint32 i, LEErrorCode &success) const {