src/java.desktop/share/native/libfontmanager/harfbuzz/hb-open-type-private.hh

@@ -103,11 +103,11 @@
   static const unsigned int static_size = (size); \
   static const unsigned int min_size = (size); \
   inline unsigned int get_size (void) const { return (size); }
 
 #define DEFINE_SIZE_UNION(size, _member) \
-  DEFINE_INSTANCE_ASSERTION (this->u._member.static_size == (size)); \
+  DEFINE_INSTANCE_ASSERTION (0*sizeof(this->u._member.static_size) + sizeof(this->u._member) == (size)); \
   static const unsigned int min_size = (size)
 
 #define DEFINE_SIZE_MIN(size) \
   DEFINE_INSTANCE_ASSERTION (sizeof (*this) >= (size)); \
   static const unsigned int min_size = (size)

@@ -648,11 +648,13 @@
   BEInt<Type, Size> v;
   public:
   DEFINE_SIZE_STATIC (Size);
 };
 
+typedef IntType<int8_t  , 1> CHAR;      /* 8-bit signed integer. */
 typedef IntType<uint8_t , 1> BYTE;      /* 8-bit unsigned integer. */
+typedef IntType<int8_t  , 1> INT8;      /* 8-bit signed integer. */
 typedef IntType<uint16_t, 2> USHORT;    /* 16-bit unsigned integer. */
 typedef IntType<int16_t,  2> SHORT;     /* 16-bit signed integer. */
 typedef IntType<uint32_t, 4> ULONG;     /* 32-bit unsigned integer. */
 typedef IntType<int32_t,  4> LONG;      /* 32-bit signed integer. */
 typedef IntType<uint32_t, 3> UINT24;    /* 24-bit unsigned integer. */

@@ -803,20 +805,22 @@
   {
     TRACE_SANITIZE (this);
     if (unlikely (!c->check_struct (this))) return_trace (false);
     unsigned int offset = *this;
     if (unlikely (!offset)) return_trace (true);
+    if (unlikely (!c->check_range (base, offset))) return_trace (false);
     const Type &obj = StructAtOffset<Type> (base, offset);
     return_trace (likely (obj.sanitize (c)) || neuter (c));
   }
   template <typename T>
   inline bool sanitize (hb_sanitize_context_t *c, const void *base, T user_data) const
   {
     TRACE_SANITIZE (this);
     if (unlikely (!c->check_struct (this))) return_trace (false);
     unsigned int offset = *this;
     if (unlikely (!offset)) return_trace (true);
+    if (unlikely (!c->check_range (base, offset))) return_trace (false);
     const Type &obj = StructAtOffset<Type> (base, offset);
     return_trace (likely (obj.sanitize (c, user_data)) || neuter (c));
   }
 
   /* Set the offset to Null */

@@ -946,12 +950,12 @@
   public:
   DEFINE_SIZE_ARRAY (sizeof (LenType), array);
 };
 
 /* Array of Offset's */
-template <typename Type>
-struct OffsetArrayOf : ArrayOf<OffsetTo<Type> > {};
+template <typename Type, typename OffsetType=USHORT>
+struct OffsetArrayOf : ArrayOf<OffsetTo<Type, OffsetType> > {};
 
 /* Array of offsets relative to the beginning of the array itself. */
 template <typename Type>
 struct OffsetListOf : OffsetArrayOf<Type>
 {