Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 5f40d9cd1dc5b537cacd8eb97de3b81e1129f140
https://github.com/WebKit/WebKit/commit/5f40d9cd1dc5b537cacd8eb97de3b81e1129f140
Author: Han Zheng <[email protected]>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp
Log Message:
-----------
Cherry-pick 320142@main (f095a382daee).
https://bugs.webkit.org/show_bug.cgi?id=322969
Validate the full FeatureList array once in OpenTypeVerticalData findFeature
https://bugs.webkit.org/show_bug.cgi?id=322969
Reviewed by Carlos Garcia Campos and Adrian Perez de Castro.
FeatureList::findFeature validated only the start of each FeatureRecord
before reading its fields, which extend to the start of the following
record. Bound the whole array up front by checking the one-past-the-end
record, matching the idiom already used by FeatureList::feature,
FeatureTable::getGlyphSubstitutions, LangSysTable::feature and
ScriptList::script, then iterate. This also hoists the check out of the
loop.
* Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp:
(WebCore::OpenType::FeatureList::findFeature const):
Canonical link: https://commits.webkit.org/320142@main
Canonical link: https://commits.webkit.org/317695.164@webkitglib/2.54
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
