tree 289fb8f4919c179420c13536cbbde06a4b8c27d3
parent a9a820217f98f7c8a207ec1e45a874e1fe12c478
author Marcel van Lohuizen <mpvl@golang.org> 1493145086 +0200
committer Marcel van Lohuizen <mpvl@golang.org> 1493285721 +0000

unicode/norm: fix panic in composition

Fixes golang/go#20079

The problem is not the bound check (something must have gone wrong
if this condition is reached).  And indeed it is.  The problem is
that false start of a Hangul UTF-8 sequence is interpreted as a
correct Hangul sequence. The single byte is then correctly
transformed to U+FFFD, but happily interpreted and decomposed as
Hangul. This is then fills up the reorder buffer with two spurious
modifier runes that are not accounted for, causing a large sequence
of trailing modifiers to overflow the buffer without being caught.

Change-Id: Ib5c7b5bc247388dffe87c0a2ba42fd1e2bb7479a
Reviewed-on: https://go-review.googlesource.com/41697
Run-TryBot: Marcel van Lohuizen <mpvl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Sam Whited <sam@samwhited.com>
Reviewed-by: Nigel Tao <nigeltao@golang.org>