From 37a5a0e7f1e0303222e6349379a6943c60f3b5b8 Mon Sep 17 00:00:00 2001 From: Trevor Spiteri Date: Tue, 15 Jan 2019 18:57:17 +0100 Subject: out-of-bounds access on Enter in new text field https://bugzilla.redhat.com/show_bug.cgi?id=1575842 Reproduce using: 1. Select text tool (F8) 2. Click on empty canvas 3. Hit Enter --- src/libnrtype/Layout-TNG-OutIter.cpp | 2 ++ 1 file changed, 2 insertions(+) (limited to 'src') diff --git a/src/libnrtype/Layout-TNG-OutIter.cpp b/src/libnrtype/Layout-TNG-OutIter.cpp index 77cedaa61..74b9494a6 100644 --- a/src/libnrtype/Layout-TNG-OutIter.cpp +++ b/src/libnrtype/Layout-TNG-OutIter.cpp @@ -183,6 +183,8 @@ Layout::iterator Layout::sourceToIterator(void *source_cookie /*, Glib::ustring: if (_input_stream[source_index]->Type() != TEXT_SOURCE) return iterator(this, char_index); + if (char_index >= _characters.size()) + return end(); return iterator(this, char_index); /* This code was never used, the text_iterator argument was "NULL" in all calling code InputStreamTextSource const *text_source = static_cast(_input_stream[source_index]); -- cgit v1.2.3