[Libreoffice-commits] core.git: Branch 'libreoffice-7-2' - vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/fontsubset/sft.cxx |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

New commits:
commit 987f34dd9a464cc6219b17f22c61c99956a2a9ed
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Feb 27 12:21:47 2022 +0000
Commit:     Michael Stahl <michael.st...@allotropia.de>
CommitDate: Tue Mar 1 18:02:00 2022 +0100

    ofz#45082 Out-of-memory
    
    Change-Id: I274a6beeec0013f5b974017500fe31bcecabfa86
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130637
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 4b54bda1767a..995c6b36373a 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -2099,10 +2099,15 @@ GlyphData *GetTTRawGlyphData(AbstractTrueTypeFont *ttf, 
sal_uInt32 glyphID)
         return nullptr;
 
     /* #127161# check the glyph offsets */
+    sal_uInt32 nNextOffset = ttf->glyphOffset(glyphID + 1);
+    sal_uInt32 nOffset = ttf->glyphOffset(glyphID);
+    if (nNextOffset < nOffset)
+        return nullptr;
+
     if (length < ttf->glyphOffset(glyphID + 1))
         return nullptr;
 
-    length = ttf->glyphOffset(glyphID + 1) - ttf->glyphOffset(glyphID);
+    length = nNextOffset - nOffset;
 
     GlyphData* d = static_cast<GlyphData*>(malloc(sizeof(GlyphData))); 
assert(d != nullptr);