<html>
  <head>
    <meta content="text/html; charset=windows-1252"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">Hi Goetz,<br>
      <br>
      Maybe instead of increasing the stack size we could move the
      increment from the assignment to the previous if statement where
      we check for the overwrite possibility?<br>
      There are similar code patterns in this file.<br>
      Also there is almost identical file LigatureSubstProc.cpp which
      also contains similar code.<br>
      <br>
      Thanks,<br>
      Vadim<br>
      <br>
      On 20.07.2016 16:13, Lindenmaier, Goetz wrote:<br>
    </div>
    <blockquote
      cite="mid:1b31ead91a874c02997770b88350ea57@DEWDFE13DE09.global.corp.sap"
      type="cite">
      <meta http-equiv="Content-Type" content="text/html;
        charset=windows-1252">
      <meta name="Generator" content="Microsoft Word 15 (filtered
        medium)">
      <style><!--
/* Font Definitions */
@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0cm;
        margin-bottom:.0001pt;
        font-size:11.0pt;
        font-family:"Calibri",sans-serif;
        mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:#0563C1;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:#954F72;
        text-decoration:underline;}
span.EmailStyle17
        {mso-style-type:personal-compose;
        font-family:"Calibri",sans-serif;
        color:windowtext;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-family:"Calibri",sans-serif;
        mso-fareast-language:EN-US;}
@page WordSection1
        {size:612.0pt 792.0pt;
        margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
        {page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
      <div class="WordSection1">
        <p class="MsoNormal"><span lang="EN-US">Hi<o:p></o:p></span></p>
        <p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span lang="EN-US">This changes fixes two
            memory issues.<o:p></o:p></span></p>
        <p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN">In awt_PrintControl.cpp, a wrong pointer is freed.
            <br>
            <br>
            In LigatureSubstProc2.cpp, line 157: <o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN">    stack[++mm] = componentGlyph;
            <o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN">can overwrite the stack by one element. It will
            write
            <o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN">stack[nComponents], because ++mm increments before
            <o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN">accessing the array.
            <o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN">Fix: increase the size of the array by one.<o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN">Please review this change:<o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN"><a moz-do-not-send="true"
href="http://cr.openjdk.java.net/%7Egoetz/wr16/8161923-jdkMem/webrev.01/">http://cr.openjdk.java.net/~goetz/wr16/8161923-jdkMem/webrev.01/</a><o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN">Best regards,<o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:DE"
            lang="EN">  Goetz.<o:p></o:p></span></p>
      </div>
    </blockquote>
    <br>
  </body>
</html>