X-Git-Url: https://git.saurik.com/apple/icu.git/blobdiff_plain/b331163bffd790ced0e88b73f44f86d49ccc48a5..ef6cf650f4a75c3f97de06b51fa104f2069b9ea2:/icuSources/layout/LETableReference.h?ds=sidebyside

diff --git a/icuSources/layout/LETableReference.h b/icuSources/layout/LETableReference.h
index de51228e..ccbe65db 100644
--- a/icuSources/layout/LETableReference.h
+++ b/icuSources/layout/LETableReference.h
@@ -179,6 +179,18 @@ public:
     return fLength;
   }
 
+  /**
+  * Throw an error if size*count overflows
+  */
+  size_t verifyLength(size_t offset, size_t size, le_uint32 count, LEErrorCode &success) {
+    if(count!=0 && size>LE_UINT32_MAX/count) {
+      LE_DEBUG_TR3("verifyLength failed size=%u, count=%u", size, count);
+      success = LE_INDEX_OUT_OF_BOUNDS_ERROR;
+      return 0;
+    }
+    return verifyLength(offset, size*count, success);
+  }
+
   /**
    * Change parent link to another
    */
@@ -269,7 +281,7 @@ public:
       if(count == LE_UNBOUNDED_ARRAY) { // not a known length
         count = getLength()/LETableVarSizer<T>::getSize(); // fit to max size
       }
-      LETableReference::verifyLength(0, LETableVarSizer<T>::getSize()*count, success);
+      LETableReference::verifyLength(0, LETableVarSizer<T>::getSize(), fCount, success);
     }
     if(LE_FAILURE(success)) {
       fCount=0;
@@ -284,7 +296,7 @@ LE_TRACE_TR("INFO: new RTAO")
       if(count == LE_UNBOUNDED_ARRAY) { // not a known length
         count = getLength()/LETableVarSizer<T>::getSize(); // fit to max size
       }
-      LETableReference::verifyLength(0, LETableVarSizer<T>::getSize()*count, success);
+      LETableReference::verifyLength(0, LETableVarSizer<T>::getSize(), fCount, success);
     }
     if(LE_FAILURE(success)) clear();
   }
@@ -295,7 +307,7 @@ LE_TRACE_TR("INFO: new RTAO")
       if(count == LE_UNBOUNDED_ARRAY) { // not a known length
         count = getLength()/LETableVarSizer<T>::getSize(); // fit to max size
       }
-      LETableReference::verifyLength(0, LETableVarSizer<T>::getSize()*count, success);
+      LETableReference::verifyLength(0, LETableVarSizer<T>::getSize(), fCount, success);
     }
     if(LE_FAILURE(success)) clear();
   }