Fix #2016: reading memory past the end of a C++ std::vector

mdboom · mdboom · commit 22e984b20052 · 2013-05-15T22:50:50.000-04:00
diff --git a/ttconv/pprdrv_tt2.cpp b/ttconv/pprdrv_tt2.cpp
@@ -700,7 +700,7 @@ void ttfont_add_glyph_dependencies(struct TTFONT *font, std::vector<int>& glyph_
 
                     std::vector<int>::iterator insertion =
                         std::lower_bound(glyph_ids.begin(), glyph_ids.end(), gind);
-                    if (*insertion != gind)
+                    if (insertion == glyph_ids.end() || *insertion != gind)
                     {
                         glyph_ids.insert(insertion, gind);
                         glyph_stack.push(gind);

Original file line number	Diff line number	Diff line change
`@@ -700,7 +700,7 @@ void ttfont_add_glyph_dependencies(struct TTFONT *font, std::vector<int>& glyph_`
`700`	`700`
`701`	`701`	`std::vector<int>::iterator insertion =`
`702`	`702`	`std::lower_bound(glyph_ids.begin(), glyph_ids.end(), gind);`
`703`		`- if (*insertion != gind)`
	`703`	`+ if (insertion == glyph_ids.end() \|\| *insertion != gind)`
`704`	`704`	`{`
`705`	`705`	`glyph_ids.insert(insertion, gind);`
`706`	`706`	`glyph_stack.push(gind);`