Index: pango1.0-1.28.1/modules/thai/thai-lang.c
===================================================================
--- pango1.0-1.28.1.orig/modules/thai/thai-lang.c	2010-07-07 14:58:28.924807499 +0700
+++ pango1.0-1.28.1/modules/thai/thai-lang.c	2010-07-07 14:59:10.837342653 +0700
@@ -76,12 +76,32 @@
   int brk_stack[512];
   thchar_t *tis_text;
   int *brk_pnts;
-  int cnt;
+  int cnt, i;
+  const char *p;
 
   if (len < 0)
     len = strlen (text);
   cnt = g_utf8_strlen (text, len) + 1;
 
+  /* Override UAX#29 GB_Prepend & GB_Extend class for caret movements.
+   * See Bug 576156.
+   */
+  for (i = 0, p = text; i < cnt; i++, p = g_utf8_next_char (p))
+    {
+      gunichar wc = g_utf8_get_char (p);
+      if (0x0E40 <= wc && wc <= 0x0E44)
+        {
+          /* GB_Prepend: override to allow cursor after it */
+          if (i + 1 < cnt)
+            attrs[i + 1].is_cursor_position = TRUE;
+        }
+      else if (wc == 0x0E30 || wc == 0x0E32 || wc == 0x0E33 || wc == 0x0E45)
+        {
+          /* GB_Extend: override to allow cursor before it */
+          attrs[i].is_cursor_position = TRUE;
+        }
+    }
+
   tis_text = tis_stack;
   if (cnt > (int) G_N_ELEMENTS (tis_stack))
     tis_text = g_new (thchar_t, cnt);
@@ -94,11 +114,11 @@
 
   /* find line break positions */
   len = th_brk (tis_text, brk_pnts, len);
-  for (cnt = 0; cnt < len; cnt++)
+  for (i = 0; i < len; i++)
     {
-      attrs[brk_pnts[cnt]].is_line_break = TRUE;
-      attrs[brk_pnts[cnt]].is_word_start = TRUE;
-      attrs[brk_pnts[cnt]].is_word_end = TRUE;
+      attrs[brk_pnts[i]].is_line_break = TRUE;
+      attrs[brk_pnts[i]].is_word_start = TRUE;
+      attrs[brk_pnts[i]].is_word_end = TRUE;
     }
 
   if (brk_pnts != brk_stack)
