It has been reported that a heap buffer overflow in code routines
responsible for transforming text runs. A page could be constructed
with a bidirectional text run which upon reflow could result in an
incorrect length being calculated for the run of text. When this
value is subsequently used to allocate memory for the text too small
a buffer may be created potentially resulting in a buffer overflow
and the execution of attacker controlled memory.