Fixed BPA stack overflow and infloop with nested brackets.

1 files changed, 20 insertions, 12 deletions

diff --git a/src/bidi.c b/src/bidi.c
index 6d5f281d571..d03aa4e3e10 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -2353,7 +2353,10 @@ typedef struct bpa_stack_entry {
   do {									\
    bpa_sp++;								\
    if (bpa_sp >= MAX_BPA_STACK)						\
-     goto bpa_give_up;							\
+     {									\
+       bpa_sp = MAX_BPA_STACK - 1;					\
+       goto bpa_give_up;						\
+     }									\
    bpa_stack[bpa_sp].close_bracket_char = bidi_mirror_char (bidi_it->ch); \
    bpa_stack[bpa_sp].open_bracket_idx = bidi_cache_last_idx;		\
    STORE_BRACKET_CHARPOS;						\
@@ -2389,10 +2392,15 @@ bidi_resolve_bracket_pairs (struct bidi_it *bidi_it)
       struct bidi_it saved_it;
       bidi_type_t last_strong;
       int embedding_level = bidi_it->level_stack[bidi_it->stack_idx].level;
+      struct bidi_it tem_it;
 
       eassert (MAX_BPA_STACK >= 100);
       bidi_copy_it (&saved_it, bidi_it);
       last_strong = bidi_it->prev_for_neutral.type;
+      /* bidi_cache_iterator_state refuses to cache on backward scans,
+	 and bidi_cache_fetch_state doesn't bring scan_dir from the
+	 cache, so we must initialize this explicitly.  */
+      tem_it.scan_dir = 1;
 
       while (1)
 	{
@@ -2422,17 +2430,16 @@ bidi_resolve_bracket_pairs (struct bidi_it *bidi_it)
 		  else if (bpa_stack[sp].flags & FLAG_OPPOSITE_INSIDE) /*N0c2*/
 		    type = ((embedding_level & 1) ? STRONG_R : STRONG_L);
 
-		  /* Update and cache the closing bracket.  */
+		  /* Update the type of the closing bracket.  */
 		  bidi_it->type = type;
-		  bidi_it->bracket_resolved = 1;
-		  bidi_cache_iterator_state (bidi_it, 0, 0);
 		  /* Update and cache the corresponding opening bracket.  */
 		  bidi_cache_fetch_state (bpa_stack[sp].open_bracket_idx,
-					  bidi_it);
+					  &tem_it);
 #ifdef ENABLE_CHECKING
-		  eassert (bpa_stack[sp].open_bracket_pos == bidi_it->charpos);
+		  eassert (bpa_stack[sp].open_bracket_pos == tem_it.charpos);
 #endif
-		  bidi_it->type = type;
+		  tem_it.type = type;
+		  bidi_cache_iterator_state (&tem_it, 0, 0);
 		  bpa_sp = sp - 1;
 		}
 	      bidi_it->bracket_resolved = 1;
@@ -2496,17 +2503,18 @@ bidi_resolve_bracket_pairs (struct bidi_it *bidi_it)
 		 isolating run sequence, and didn't find matching
 		 closing brackets for some opening brackets.  Unwind
 		 whatever is left on the BPA stack, and mark each
-		 bracket there as BPA-resolved.  */
+		 bracket there as BPA-resolved, leaving their type
+		 unchanged.  */
 	      while (bpa_sp >= 0)
 		{
 		  bidi_cache_fetch_state (bpa_stack[bpa_sp].open_bracket_idx,
-					  bidi_it);
+					  &tem_it);
 #ifdef ENABLE_CHECKING
 		  eassert (bpa_stack[bpa_sp].open_bracket_pos
-			   == bidi_it->charpos);
+			   == tem_it.charpos);
 #endif
-		  bidi_it->bracket_resolved = 1;
-		  bidi_cache_iterator_state (bidi_it, 0, 0);
+		  tem_it.bracket_resolved = 1;
+		  bidi_cache_iterator_state (&tem_it, 0, 0);
 		  bpa_sp--;
 		}
 	      type = saved_it.type;