diff options
| author | Trevor Spiteri <trevor.spiteri@um.edu.mt> | 2019-01-15 17:58:59 +0000 |
|---|---|---|
| committer | Trevor Spiteri <trevor.spiteri@um.edu.mt> | 2019-01-15 17:58:59 +0000 |
| commit | 5ed5cde1a9a0f7368e33d5ec38d9dbb9aa817af9 (patch) | |
| tree | 654af4828e4bdfd04adc960414823e839d45402c /src/libnrtype | |
| parent | out-of-bounds access on clicking at end of text field (diff) | |
| download | inkscape-5ed5cde1a9a0f7368e33d5ec38d9dbb9aa817af9.tar.gz inkscape-5ed5cde1a9a0f7368e33d5ec38d9dbb9aa817af9.zip | |
out-of-bounds access on Enter-up-down in new text field
https://bugzilla.redhat.com/show_bug.cgi?id=1612618
Reproduce using:
1. Select text tool (F8)
2. Click on empty canvas
3. Hit Enter
4. Hit Up
5. Hit Down
Diffstat (limited to 'src/libnrtype')
| -rw-r--r-- | src/libnrtype/Layout-TNG-OutIter.cpp | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/libnrtype/Layout-TNG-OutIter.cpp b/src/libnrtype/Layout-TNG-OutIter.cpp index 3dc5c3e4f..761d58245 100644 --- a/src/libnrtype/Layout-TNG-OutIter.cpp +++ b/src/libnrtype/Layout-TNG-OutIter.cpp @@ -789,7 +789,10 @@ bool Layout::iterator::nextLineCursor(int n) - _parent_layout->_chunks[_parent_layout->_spans[_parent_layout->_lineToSpan(line_index)].in_chunk].left_x; } _char_index = _parent_layout->_cursorXOnLineToIterator(line_index + n, _x_coordinate)._char_index; - _glyph_index = _parent_layout->_characters[_char_index].in_glyph; + if (_char_index == _parent_layout->_characters.size()) + _glyph_index = _parent_layout->_glyphs.size(); + else + _glyph_index = _parent_layout->_characters[_char_index].in_glyph; return true; } |