[UFO-devel] ufo::UTextLayout crash

[Andreas B. <b_...@gm...>]

Hi
when maxWidth is 0 by some reason, ufo::UTextLayout::getPreferredSize() may 
crash due to a line length of 4294967295.

The reason is that in ufo::UTextLayout::layout() lineStart will be increased 
by 1 per iteration. Therefore it is at 1 in the 2nd iteration - but the line
int wrap_index = (index > 0) ? index - 1 : 0;
causes wrap_index to be 0 then.
Therefore
 UTextLine line(lineStart, wrap_index - lineStart, lineHeight, pos);
causes a length of 0-1 which is an underflow for uints.

Patch attached.

CU
Andi