extra/qt to 4.8.2-1

This commit is contained in:
Kevin Mihelich 2012-05-24 08:50:58 -04:00
parent c54ec2edcd
commit c526ccc812
3 changed files with 0 additions and 92 deletions

View file

@ -1,33 +0,0 @@
From 827e5c4c689d4ecb4f8c1ab48c9a7ab712fe2ca7 Mon Sep 17 00:00:00 2001
From: John Tapsell <john.tapsell.ext@basyskom.com>
Date: Mon, 12 Mar 2012 22:07:47 +0000
Subject: [PATCH] Harfbuzz-thai - fix buffer overflow when setting item
attributes
Change-Id: I19eeb4ec25a7c6cb3f584e6290169f9f327b8713
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@nokia.com>
---
src/3rdparty/harfbuzz/src/harfbuzz-thai.c | 9 +++++-
.../qtextscriptengine/tst_qtextscriptengine.cpp | 29 ++++++++++++++++++++
2 files changed, 36 insertions(+), 2 deletions(-)
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-thai.c b/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
index bf6c35b..3c0ffe8 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
@@ -263,8 +263,13 @@ static HB_Bool HB_ThaiConvertStringToGlyphIndices (HB_ShaperItem *item)
// The only glyphs that should be passed to this function that cannot be mapped to
// tis620 are the ones of type Inherited class. Pass these glyphs untouched.
glyphString[slen++] = string[i];
- if (string[i] == 0x200D || string[i] == 0x200C)
- item->attributes[slen-1].dontPrint = true; // Hide ZWJ and ZWNJ characters
+ if (string[i] == 0x200D || string[i] == 0x200C) {
+ // Check that we do not run out of bounds when setting item->attributes. If we do
+ // run out of bounds then this function will return false, the necessary amount of
+ // memory is reallocated, and this function will then be called again.
+ if (slen <= item->num_glyphs)
+ item->attributes[slen-1].dontPrint = true; // Hide ZWJ and ZWNJ characters
+ }
} else {
glyphString[slen++] = (HB_UChar16) thai_get_glyph_index (font_type, rglyphs[lgi]);
}

View file

@ -1,32 +0,0 @@
Index: fix-cursortox-crash.patch
===================================================================
--- fix-cursortox-crash.patch (revision 0)
+++ fix-cursortox-crash.patch (arbetskopia)
#commit cac12f4592477d99ef6fffaad40345bf85ef53b5
#Author: Jiang Jiang <jiang.jiang@nokia.com>
#Date: Mon Apr 2 12:32:05 2012 +0200
#
# Fix a crash in cursorToX() when new block is added
#
# When an empty new block is being added, the layoutData->memory data
# will be 0, thus QTextEngine::attributes() will return 0. We should
# only access the attributes pointer when some text actually exist.
#
# Task-number: QTBUG-24718
# Change-Id: I9ce9f7b57bccf24099a02832ce30fb6cebfaad33
#
diff --git a/src/gui/text/qtextlayout.cpp b/src/gui/text/qtextlayout.cpp
index ee658d9..16f7150 100644
--- a/src/gui/text/qtextlayout.cpp
+++ b/src/gui/text/qtextlayout.cpp
@@ -2508,6 +2508,10 @@ qreal QTextLine::cursorToX(int *cursorPos, Edge edge) const
int pos = *cursorPos;
int itm;
const HB_CharAttributes *attributes = eng->attributes();
+ if (!attributes) {
+ *cursorPos = 0;
+ return x.toReal();
+ }
while (pos < line.from + line.length && !attributes[pos].charStop)
pos++;
if (pos == line.from + (int)line.length) {

View file

@ -1,27 +0,0 @@
diff -up qt-everywhere-opensource-src-4.8.0/src/3rdparty/javascriptcore/JavaScriptCore/runtime/JSGlobalObject.h.me qt-everywhere-opensource-src-4.8.0/src/3rdparty/javascriptcore/JavaScriptCore/runtime/JSGlobalObject.h
--- qt-everywhere-opensource-src-4.8.0/src/3rdparty/javascriptcore/JavaScriptCore/runtime/JSGlobalObject.h.me 2012-01-24 11:24:14.729942043 +0100
+++ qt-everywhere-opensource-src-4.8.0/src/3rdparty/javascriptcore/JavaScriptCore/runtime/JSGlobalObject.h 2012-01-24 14:28:39.848109534 +0100
@@ -57,9 +57,7 @@ namespace JSC {
class JSGlobalObject : public JSVariableObject {
protected:
- using JSVariableObject::JSVariableObjectData;
-
- struct JSGlobalObjectData : public JSVariableObjectData {
+ struct JSGlobalObjectData : public JSVariableObject::JSVariableObjectData {
// We use an explicit destructor function pointer instead of a
// virtual destructor because we want to avoid adding a vtable
// pointer to this struct. Adding a vtable pointer would force the
diff -up qt-everywhere-opensource-src-4.8.0/src/3rdparty/javascriptcore/JavaScriptCore/runtime/JSStaticScopeObject.h.me qt-everywhere-opensource-src-4.8.0/src/3rdparty/javascriptcore/JavaScriptCore/runtime/JSStaticScopeObject.h
--- qt-everywhere-opensource-src-4.8.0/src/3rdparty/javascriptcore/JavaScriptCore/runtime/JSStaticScopeObject.h.me 2012-01-24 11:40:07.167856677 +0100
+++ qt-everywhere-opensource-src-4.8.0/src/3rdparty/javascriptcore/JavaScriptCore/runtime/JSStaticScopeObject.h 2012-01-24 14:28:34.640306629 +0100
@@ -32,8 +32,7 @@ namespace JSC{
class JSStaticScopeObject : public JSVariableObject {
protected:
- using JSVariableObject::JSVariableObjectData;
- struct JSStaticScopeObjectData : public JSVariableObjectData {
+ struct JSStaticScopeObjectData : public JSVariableObject::JSVariableObjectData {
JSStaticScopeObjectData()
: JSVariableObjectData(&symbolTable, &registerStore + 1)
{