Changeset 90908 in webkit

Timestamp:

Jul 13, 2011, 5:54:52 AM (15 years ago)

Author:

Nikolas Zimmermann

Message:

2011-07-13 Nikolas Zimmermann <​nzimmermann@rim.com>

Regression: OOB read in svg text run
​https://bugs.webkit.org/show_bug.cgi?id=63627

Not reviewed.

Fixed last minute typo leading to assertions.

• rendering/InlineTextBox.cpp: (WebCore::InlineTextBox::paintSelection):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/InlineTextBox.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-07-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Regression: OOB read in svg text run
+        https://bugs.webkit.org/show_bug.cgi?id=63627
+
+        Not reviewed.
+
+        Fixed last minute typo leading to assertions.
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintSelection):
+
 2011-07-12  Andrey Kosyakov  <caseq@chromium.org>
 

trunk/Source/WebCore/rendering/InlineTextBox.cpp

@@ -818 +818 @@
     BufferForAppendingHyphen charactersWithHyphen;
     bool respectHyphen = ePos == length && hasHyphen();
-    TextRun textRun = constructTextRun(style, font, characters, length, textRenderer()->textLength() - length, respectHyphen ? &charactersWithHyphen : 0);
+    TextRun textRun = constructTextRun(style, font, characters, length, textRenderer()->textLength() - m_start, respectHyphen ? &charactersWithHyphen : 0);
     if (respectHyphen)
         ePos = textRun.length();