#2522 Out-of-bounds read in LineLayout::CalculatePositions for empty lines?

[Martijn Laan]

In 5.6.7, LineLayout::CalculatePositions indexes chars and styles with numCharsBeforeEOL - 1:

const bool lastSegItalics = (chars[numCharsBeforeEOL - 1] != ' ') && vstyle.styles[styles[numCharsBeforeEOL - 1]].italic;

For an empty line numCharsBeforeEOL is 0, and LayoutLine calls CalculatePositions for empty lines too, so this reads before the start of both arrays. Right?

[Zufu Liu]

Already fixed by commit [4dfc95].

[Martijn Laan]

Ah, thanks!