diff --git a/icu4c/source/layout/Features.cpp b/icu4c/source/layout/Features.cpp index 74e2030c44a..0f964f7ae71 100644 --- a/icu4c/source/layout/Features.cpp +++ b/icu4c/source/layout/Features.cpp @@ -16,7 +16,7 @@ U_NAMESPACE_BEGIN LEReferenceTo FeatureListTable::getFeatureTable(const LETableReference &base, le_uint16 featureIndex, LETag *featureTag, LEErrorCode &success) const { LEReferenceToArrayOf - featureRecordArrayRef(base, success, featureRecordArray, featureIndex); + featureRecordArrayRef(base, success, featureRecordArray, featureIndex+1); if (featureIndex >= SWAPW(featureCount) || LE_FAILURE(success)) { return LEReferenceTo(); diff --git a/icu4c/source/layout/LETableReference.h b/icu4c/source/layout/LETableReference.h index de51228ead5..ccbe65dbc38 100644 --- a/icu4c/source/layout/LETableReference.h +++ b/icu4c/source/layout/LETableReference.h @@ -179,6 +179,18 @@ public: return fLength; } + /** + * Throw an error if size*count overflows + */ + size_t verifyLength(size_t offset, size_t size, le_uint32 count, LEErrorCode &success) { + if(count!=0 && size>LE_UINT32_MAX/count) { + LE_DEBUG_TR3("verifyLength failed size=%u, count=%u", size, count); + success = LE_INDEX_OUT_OF_BOUNDS_ERROR; + return 0; + } + return verifyLength(offset, size*count, success); + } + /** * Change parent link to another */ @@ -269,7 +281,7 @@ public: if(count == LE_UNBOUNDED_ARRAY) { // not a known length count = getLength()/LETableVarSizer::getSize(); // fit to max size } - LETableReference::verifyLength(0, LETableVarSizer::getSize()*count, success); + LETableReference::verifyLength(0, LETableVarSizer::getSize(), fCount, success); } if(LE_FAILURE(success)) { fCount=0; @@ -284,7 +296,7 @@ LE_TRACE_TR("INFO: new RTAO") if(count == LE_UNBOUNDED_ARRAY) { // not a known length count = getLength()/LETableVarSizer::getSize(); // fit to max size } - LETableReference::verifyLength(0, LETableVarSizer::getSize()*count, success); + LETableReference::verifyLength(0, LETableVarSizer::getSize(), fCount, success); } if(LE_FAILURE(success)) clear(); } @@ -295,7 +307,7 @@ LE_TRACE_TR("INFO: new RTAO") if(count == LE_UNBOUNDED_ARRAY) { // not a known length count = getLength()/LETableVarSizer::getSize(); // fit to max size } - LETableReference::verifyLength(0, LETableVarSizer::getSize()*count, success); + LETableReference::verifyLength(0, LETableVarSizer::getSize(), fCount, success); } if(LE_FAILURE(success)) clear(); }