vcl/source/fontsubset/sft.cxx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
New commits: commit d566c200995d2124fb76adc9484cb8ef58ab78ae Author: Caolán McNamara <caol...@redhat.com> Date: Wed Feb 7 16:57:27 2018 +0000 check kern table size Change-Id: I65b5f0a8950d54c00d6fd7c385ca1c5dca2ef2c8 Reviewed-on: https://gerrit.libreoffice.org/49384 Tested-by: Jenkins <c...@libreoffice.org> Reviewed-by: Michael Stahl <mst...@redhat.com> diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 2170acd08d1c..28713f47dbd7 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1354,7 +1354,7 @@ static void GetKern(TrueTypeFont *ttf) if( !table ) goto badtable; - if (GetUInt16(table, 0) == 0) { /* Traditional Microsoft style table with sal_uInt16 version and nTables fields */ + if (nTableSize >= 4 && GetUInt16(table, 0) == 0) { /* Traditional Microsoft style table with sal_uInt16 version and nTables fields */ ttf->nkern = GetUInt16(table, 2); ttf->kerntype = KT_MICROSOFT; ptr = table + 4; @@ -1386,7 +1386,7 @@ static void GetKern(TrueTypeFont *ttf) return; } - if (GetUInt32(table, 0) == 0x00010000) { /* MacOS style kern tables: fixed32 version and sal_uInt32 nTables fields */ + if (nTableSize >= 8 && GetUInt32(table, 0) == 0x00010000) { /* MacOS style kern tables: fixed32 version and sal_uInt32 nTables fields */ ttf->nkern = GetUInt32(table, 4); ttf->kerntype = KT_APPLE_NEW; ptr = table + 8; _______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits