From e8cd0b0df7d39639ba7561f82d06f831738c5efd Mon Sep 17 00:00:00 2001
From: Allan Odgaard <git@abetarda.com>
Date: Tue, 5 Mar 2013 16:42:22 +0100
Subject: [PATCH] Reject bad folding meta data

Fixes issue #866.
---
 Frameworks/layout/src/folds.cc | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/Frameworks/layout/src/folds.cc b/Frameworks/layout/src/folds.cc
index 68f19b45..94c7204f 100644
--- a/Frameworks/layout/src/folds.cc
+++ b/Frameworks/layout/src/folds.cc
@@ -29,6 +29,8 @@ namespace ng
 		plist::any_t value = plist::parse_ascii(str);
 		if(plist::array_t const* array = boost::get<plist::array_t>(&value))
 		{
+			bool validRanges = true;
+
 			std::vector< std::pair<size_t, size_t> > newFoldings;
 			iterate(pair, *array)
 			{
@@ -36,11 +38,14 @@ namespace ng
 				{
 					int32_t const* from = value->size() == 2 ? boost::get<int32_t>(&(*value)[0]) : NULL;
 					int32_t const* to   = value->size() == 2 ? boost::get<int32_t>(&(*value)[1]) : NULL;
-					if(from && to)
-						newFoldings.push_back(std::make_pair(*from, *to));
+					if(from && *from < _buffer.size() && to && *to < _buffer.size())
+							newFoldings.push_back(std::make_pair(*from, *to));
+					else	validRanges = false;
 				}
 			}
-			set_folded(newFoldings);
+
+			if(validRanges)
+				set_folded(newFoldings);
 		}
 	}