commit be8c6381b93a634d6c67a6e3d52c00df864ed461
author bashi@chromium.org <bashi@chromium.org@a4e77c2c-9104-11de-800e-5b313e0d2bf3> Sat Mar 03 11:08:05 2012 +0000
committer bashi@chromium.org <bashi@chromium.org@a4e77c2c-9104-11de-800e-5b313e0d2bf3> Sat Mar 03 11:08:05 2012 +0000
tree 5c8a36a48b02f1b0dacfc8c39c58253ecaadabca
parent 98281afef95be7fee74edc8df7351f8b5e9969d1

[OTS] Fix off-by-one in GSUB/GPOS parser

Use the number of cells in the sub-parser table for number of lookup type.

BUG=chromium:116524
TEST=ran test_{un,}malicious_fonts.sh
Review URL: http://codereview.chromium.org/9581044

git-svn-id: http://ots.googlecode.com/svn/trunk@83 a4e77c2c-9104-11de-800e-5b313e0d2bf3

src/gsub.cc

diff --git a/src/gsub.cc b/src/gsub.cc
index e093c3a..b38ebcb 100644
--- a/src/gsub.cc
+++ b/src/gsub.cc
@@ -63,8 +63,10 @@
     ParseReverseChainingContextSingleSubstitution}
 };
 
+// TODO(bashi): Port Chromium's arraysize macro and use it instead of sizeof().
 const ots::LookupSubtableParser kGsubLookupSubtableParser = {
-  GSUB_TYPE_RESERVED, GSUB_TYPE_EXTENSION_SUBSTITUTION, kGsubTypeParsers
+  sizeof(kGsubTypeParsers) / sizeof(kGsubTypeParsers[0]),
+  GSUB_TYPE_EXTENSION_SUBSTITUTION, kGsubTypeParsers
 };
 
 // Lookup Type 1: