603352 - infinite loop in hb_ot_tag_from_language because i is never incremented

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[timeless]

618 hb_ot_tag_from_language (hb_language_t language)

638     while (i < 4)
639       tag[i] = ' ';

Comment 1

[timeless]

618 hb_ot_tag_from_language (hb_language_t language)

628   if (0 == strcmp (lang_str, "x-hbot")) {
629     char tag[4];
630     int i;
631     lang_str += 6;
632     i = 0;

actually, you'll get trapped in this loop:
635     while (i < 4 && IS_LETTER (lang_str[i])) {
636       tag[i] = TO_UPPER (lang_str[i]);
637     }
long before you get trapped in this loop ...
638     while (i < 4)
639       tag[i] = ' ';

Comment 2

[timeless]

Attachment: proposal

Comment 3

[Jonathan Kew [:jfkthame]]

Yes, this is clearly bad! Fortunately, we don't use that codepath.

Reported this upstream to Behdad and the harfbuzz list; I expect he'll fix it shortly.

Comment 4

[Behdad Esfahbod]

Indeed, untested code is buggy code.  Fixed.  Thanks.

Comment 5

[Jonathan Kew [:jfkthame]]

Comment on attachment 482490 [details] [diff] [review]
proposal

We've landed a harfbuzz update that includes a version of this fix, so we can close this.