diff options
| author |   Dan Zivkovic <zivkovic@google.com> | 2015-02-27 10:13:06 -0800 |
|---|---|---|
| committer | Dan Zivkovic <zivkovic@google.com> | 2015-02-27 10:29:47 -0800 |
| commit | 69c04cadc7c017f9de53f13ea045347b80316d4a (patch) | |
| tree | 5593b38ec5da9bb611fa1ce2c6f30824812dc23d /java-overridable | |
| parent | 8472b36886c1b94ad308cc3479acb2215ac44318 (diff) | |
| download | latinime-69c04cadc7c017f9de53f13ea045347b80316d4a.tar.gz latinime-69c04cadc7c017f9de53f13ea045347b80316d4a.tar.xz latinime-69c04cadc7c017f9de53f13ea045347b80316d4a.zip | |
Race condition in cursor move.
The method WordComposer.moveCursorByAndReturnIfInsideComposingWord() iterates
through all the code points in the word that's currently being composed, and
it tries to adjust the cursor position by a given amount (left or right).
It copies the code points to a new array while processing. But the code point
count comes from a member variable. If the member variable changes while the
method is processing the copy of the code points, it can run over the length
of the code point array.
Bug 18876474.
Change-Id: Ib3a2d90a4e82b76d381efa774e6b3d6bca99c869
Diffstat (limited to 'java-overridable')
0 files changed, 0 insertions, 0 deletions