diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2022-07-16 11:37:22 +0100 |
|---|---|---|
| committer | Michael Stahl <michael.stahl@allotropia.de> | 2022-07-18 11:00:51 +0200 |
| commit | 07768f467736f6ab558c5c6975a9baab09dc92ec (patch) | |
| tree | 8e206a18efc9cf64406c29a340120bfbe0789075 | |
| parent | 6c99d0c7f326cbe09a42a879c8acce61b6472453 (diff) | |
ofz#49157 Object-size
Change-Id: I3a17d7967512a282b13894ba479aa3507f1be38f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/137069
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
| -rw-r--r-- | vcl/source/filter/svm/SvmConverter.cxx | 25 |
1 files changed, 15 insertions, 10 deletions
diff --git a/vcl/source/filter/svm/SvmConverter.cxx b/vcl/source/filter/svm/SvmConverter.cxx index ac1592efb498..abe2193ae118 100644 --- a/vcl/source/filter/svm/SvmConverter.cxx +++ b/vcl/source/filter/svm/SvmConverter.cxx @@ -781,17 +781,22 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf ) aFontVDev->GetTextArray( aStr, &aTmpAry, nIndex, nLen ); - // now, the difference between the - // last and the second last DX array - // is the advancement for the last - // glyph. Thus, to complete our meta - // action's DX array, just add that - // difference to last elem and store - // in very last. - if( nStrLen > 1 ) - aDXAry[ nStrLen-1 ] = aDXAry[ nStrLen-2 ] + aTmpAry[ nStrLen-1 ] - aTmpAry[ nStrLen-2 ]; + if (aTmpAry.size() < o3tl::make_unsigned(nStrLen)) + SAL_WARN("vcl.gdi", "TextArray too short to recover missing element"); else - aDXAry[ nStrLen-1 ] = aTmpAry[ nStrLen-1 ]; // len=1: 0th position taken to be 0 + { + // now, the difference between the + // last and the second last DX array + // is the advancement for the last + // glyph. Thus, to complete our meta + // action's DX array, just add that + // difference to last elem and store + // in very last. + if( nStrLen > 1 ) + aDXAry[ nStrLen-1 ] = aDXAry[ nStrLen-2 ] + aTmpAry[ nStrLen-1 ] - aTmpAry[ nStrLen-2 ]; + else + aDXAry[ nStrLen-1 ] = aTmpAry[ nStrLen-1 ]; // len=1: 0th position taken to be 0 + } } #ifdef DBG_UTIL else |