From decb8fcb692a1d743b3e5fd9b7105854a9be0974 Mon Sep 17 00:00:00 2001 From: Trevor Spiteri Date: Tue, 15 Jan 2019 18:58:59 +0100 Subject: [PATCH] out-of-bounds access on Enter-up-down in new text field https://bugzilla.redhat.com/show_bug.cgi?id=1612618 Reproduce using: 1. Select text tool (F8) 2. Click on empty canvas 3. Hit Enter 4. Hit Up 5. Hit Down Backport from 1.0alpha master Cherry picked from 5ed5cde1a9a0f7368e33d5ec38d9dbb9aa817af9 --- src/libnrtype/Layout-TNG-OutIter.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/libnrtype/Layout-TNG-OutIter.cpp b/src/libnrtype/Layout-TNG-OutIter.cpp index 296fa5037d..3dd02bdffe 100644 --- a/src/libnrtype/Layout-TNG-OutIter.cpp +++ b/src/libnrtype/Layout-TNG-OutIter.cpp @@ -788,7 +788,10 @@ bool Layout::iterator::nextLineCursor(int n) - _parent_layout->_chunks[_parent_layout->_spans[_parent_layout->_lineToSpan(line_index)].in_chunk].left_x; } _char_index = _parent_layout->_cursorXOnLineToIterator(line_index + n, _x_coordinate)._char_index; - _glyph_index = _parent_layout->_characters[_char_index].in_glyph; + if (_char_index == _parent_layout->_characters.size()) + _glyph_index = _parent_layout->_glyphs.size(); + else + _glyph_index = _parent_layout->_characters[_char_index].in_glyph; return true; } -- GitLab