[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/fontsubset/sft.cxx |   16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

New commits:
commit 0dcd6317f3722f637cd28728fadde595c26d78d9
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Thu Mar 3 09:43:08 2022 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Thu Mar 3 16:28:52 2022 +0100

    ofz: check hmtx offset
    
    Change-Id: I650a37472c70771d40febe52efcb723195856421
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130911
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 7a77d1961a6d..e8b406a27d14 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -2240,8 +2240,20 @@ GlyphData *GetTTRawGlyphData(AbstractTrueTypeFont *ttf, 
sal_uInt32 glyphID)
         nLsboffset = (ttf->horzMetricCount() * 4) + ((glyphID - 
ttf->horzMetricCount()) * 2);
     }
 
-    d->aw = GetUInt16(hmtx, nAwOffset);
-    d->lsb = GetInt16(hmtx, nLsboffset);
+    if (nAwOffset + 2 <= hmtxlength)
+        d->aw = GetUInt16(hmtx, nAwOffset);
+    else
+    {
+        SAL_WARN("vcl.fonts", "hmtx offset " << nAwOffset << " not available");
+        d->aw = 0;
+    }
+    if (nLsboffset + 2 <= hmtxlength)
+        d->lsb = GetInt16(hmtx, nLsboffset);
+    else
+    {
+        SAL_WARN("vcl.fonts", "hmtx offset " << nLsboffset << " not 
available");
+        d->lsb = 0;
+    }
 
     return d;
 }