Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 9ee9108866ce671f29f6f3913e8ea4578d0439a6
https://github.com/WebKit/WebKit/commit/9ee9108866ce671f29f6f3913e8ea4578d0439a6
Author: Han Zheng <[email protected]>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp
Log Message:
-----------
Cherry-pick 320142@main (f095a382daee).
https://bugs.webkit.org/show_bug.cgi?id=322969
Validate the full FeatureList array once in OpenTypeVerticalData findFeature
https://bugs.webkit.org/show_bug.cgi?id=322969
Reviewed by Carlos Garcia Campos and Adrian Perez de Castro.
FeatureList::findFeature validated only the start of each FeatureRecord
before reading its fields, which extend to the start of the following
record. Bound the whole array up front by checking the one-past-the-end
record, matching the idiom already used by FeatureList::feature,
FeatureTable::getGlyphSubstitutions, LangSysTable::feature and
ScriptList::script, then iterate. This also hoists the check out of the
loop.
* Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp:
(WebCore::OpenType::FeatureList::findFeature const):
Canonical link: https://commits.webkit.org/320142@main
Canonical link: https://commits.webkit.org/305877.1129@webkitglib/2.52
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
