diff --git a/jdk/src/share/classes/sun/font/GlyphLayout.java b/jdk/src/share/classes/sun/font/GlyphLayout.java index d29ecf34cb2..f2fc484caa0 100644 --- a/jdk/src/share/classes/sun/font/GlyphLayout.java +++ b/jdk/src/share/classes/sun/font/GlyphLayout.java @@ -468,9 +468,10 @@ public final class GlyphLayout { _gvdata.grow(); } } - if (_gvdata._count < 0) { - break; - } + } + // Break out of the outer for loop if layout fails. + if (_gvdata._count < 0) { + break; } } diff --git a/jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp b/jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp index b32f2601b4d..858e3636038 100644 --- a/jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp +++ b/jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp @@ -104,6 +104,10 @@ Java_sun_font_SunLayoutEngine_initGVIDs int putGV(JNIEnv* env, jint gmask, jint baseIndex, jobject gvdata, const LayoutEngine* engine, int glyphCount) { int count = env->GetIntField(gvdata, gvdCountFID); + if (count < 0) { + JNU_ThrowInternalError(env, "count negative"); + return 0; + } jarray glyphArray = (jarray)env->GetObjectField(gvdata, gvdGlyphsFID); if (IS_NULL(glyphArray)) {