X-Git-Url: https://git.saurik.com/apple/icu.git/blobdiff_plain/b75a7d8f3b4adbae880cab104ce2c6a50eee4db2..4388f060552cc537e71e957d32f35e9d75a61233:/icuSources/layout/ScriptAndLanguage.cpp

diff --git a/icuSources/layout/ScriptAndLanguage.cpp b/icuSources/layout/ScriptAndLanguage.cpp
index 80941a5d..126f5f2f 100644
--- a/icuSources/layout/ScriptAndLanguage.cpp
+++ b/icuSources/layout/ScriptAndLanguage.cpp
@@ -1,7 +1,5 @@
 /*
- * %W% %E%
- *
- * (C) Copyright IBM Corp. 1998-2003 - All Rights Reserved
+ * (C) Copyright IBM Corp. 1998-2008 - All Rights Reserved
  *
  */
 
@@ -31,20 +29,45 @@ const LangSysTable *ScriptTable::findLanguage(LETag languageTag, le_bool exactMa
         return (const LangSysTable *) ((char *)this + langSysTableOffset);
     }
 
-    return 0;
+    return NULL;
 }
 
 const ScriptTable *ScriptListTable::findScript(LETag scriptTag) const
 {
+    /*
+     * There are some fonts that have a large, bogus value for scriptCount. To try
+     * and protect against this, we use the offset in the first scriptRecord,
+     * which we know has to be past the end of the scriptRecordArray, to compute
+     * a value which is greater than or equal to the actual script count.
+     *
+     * Note: normally, the first offset will point to just after the scriptRecordArray,
+     * but there's no guarantee of this, only that it's *after* the scriptRecordArray.
+     * Because of this, a binary serach isn't safe, because the new count may include
+     * data that's not actually in the scriptRecordArray and hence the array will appear
+     * to be unsorted.
+     */
     le_uint16 count = SWAPW(scriptCount);
-    Offset scriptTableOffset =
-        OpenTypeUtilities::getTagOffset(scriptTag, scriptRecordArray, count);
+    le_uint16 limit = ((SWAPW(scriptRecordArray[0].offset) - sizeof(ScriptListTable)) / sizeof(scriptRecordArray)) + ANY_NUMBER;
+    Offset scriptTableOffset = 0;
+
+    if (count > limit) {
+        // the scriptCount value is bogus; do a linear search
+        // because limit may still be too large.
+        for(le_int32 s = 0; s < limit; s += 1) {
+            if (SWAPT(scriptRecordArray[s].tag) == scriptTag) {
+                scriptTableOffset = SWAPW(scriptRecordArray[s].offset);
+                break;
+            }
+        }
+    } else {
+        scriptTableOffset = OpenTypeUtilities::getTagOffset(scriptTag, scriptRecordArray, count);
+    }
 
     if (scriptTableOffset != 0) {
         return (const ScriptTable *) ((char *)this + scriptTableOffset);
     }
 
-    return 0;
+    return NULL;
 }
 
 const LangSysTable *ScriptListTable::findLanguage(LETag scriptTag, LETag languageTag, le_bool exactMatch) const
@@ -52,7 +75,7 @@ const LangSysTable *ScriptListTable::findLanguage(LETag scriptTag, LETag languag
     const ScriptTable *scriptTable = findScript(scriptTag);
 
     if (scriptTable == 0) {
-        return 0;
+        return NULL;
     }
 
     return scriptTable->findLanguage(languageTag, exactMatch);