diff options
| author | Trevor Spiteri <trevor.spiteri@um.edu.mt> | 2019-01-15 17:57:17 +0000 |
|---|---|---|
| committer | Trevor Spiteri <trevor.spiteri@um.edu.mt> | 2019-01-15 17:57:17 +0000 |
| commit | 37a5a0e7f1e0303222e6349379a6943c60f3b5b8 (patch) | |
| tree | c62e70ad9e8d7f48e2ab3830ad0699827450f282 /src/libnrtype | |
| parent | Merge branch 'master' of gitlab.com:inkscape/inkscape (diff) | |
| download | inkscape-37a5a0e7f1e0303222e6349379a6943c60f3b5b8.tar.gz inkscape-37a5a0e7f1e0303222e6349379a6943c60f3b5b8.zip | |
out-of-bounds access on Enter in new text field
https://bugzilla.redhat.com/show_bug.cgi?id=1575842
Reproduce using:
1. Select text tool (F8)
2. Click on empty canvas
3. Hit Enter
Diffstat (limited to 'src/libnrtype')
| -rw-r--r-- | src/libnrtype/Layout-TNG-OutIter.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/libnrtype/Layout-TNG-OutIter.cpp b/src/libnrtype/Layout-TNG-OutIter.cpp index 77cedaa61..74b9494a6 100644 --- a/src/libnrtype/Layout-TNG-OutIter.cpp +++ b/src/libnrtype/Layout-TNG-OutIter.cpp @@ -183,6 +183,8 @@ Layout::iterator Layout::sourceToIterator(void *source_cookie /*, Glib::ustring: if (_input_stream[source_index]->Type() != TEXT_SOURCE) return iterator(this, char_index); + if (char_index >= _characters.size()) + return end(); return iterator(this, char_index); /* This code was never used, the text_iterator argument was "NULL" in all calling code InputStreamTextSource const *text_source = static_cast<InputStreamTextSource const *>(_input_stream[source_index]); |