vcl/source/fontsubset/sft.cxx | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
New commits: commit 26abdb564dad2011a298fc1253279232cb8b59cf Author: Caolán McNamara <caol...@redhat.com> AuthorDate: Mon Feb 28 21:12:07 2022 +0000 Commit: Caolán McNamara <caol...@redhat.com> CommitDate: Tue Mar 1 18:23:32 2022 +0100 ofz: measure maximum possible contours Change-Id: Ie039abd835fef06514edde12b99e17360f5481a5 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130774 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.st...@allotropia.de> diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 995c6b36373a..baa54d3378b7 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -347,7 +347,13 @@ static int GetSimpleTTOutline(AbstractTrueTypeFont const *ttf, sal_uInt32 glyphI if (glyphID >= ttf->glyphCount()) return 0; - const sal_uInt8* ptr = table + ttf->glyphOffset(glyphID); + sal_uInt32 nGlyphOffset = ttf->glyphOffset(glyphID); + if (nGlyphOffset > nTableSize) + return 0; + + const sal_uInt8* ptr = table + nGlyphOffset; + const sal_uInt32 nMaxGlyphSize = nTableSize - nGlyphOffset; + const sal_Int16 numberOfContours = GetInt16(ptr, GLYF_numberOfContours_offset); if( numberOfContours <= 0 ) /*- glyph is not simple */ return 0; @@ -362,7 +368,7 @@ static int GetSimpleTTOutline(AbstractTrueTypeFont const *ttf, sal_uInt32 glyphI /* determine the last point and be extra safe about it. But probably this code is not needed */ sal_uInt16 lastPoint=0; - const sal_Int32 nMaxContours = (nTableSize - 10)/2; + const sal_Int32 nMaxContours = (nMaxGlyphSize - 10)/2; if (numberOfContours > nMaxContours) return 0; for (i=0; i<numberOfContours; i++)