diff options
author | Caolán McNamara <caolanm@redhat.com> | 2018-02-08 23:57:14 +0000 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2018-02-09 10:16:01 +0000 |
commit | f832198e6a33052c7cc86b25843badfb962a2ae8 (patch) | |
tree | 759c518688dc5c49f8cacb0fa7172f82e21ecc09 | |
parent | bb32616bdd6e3b327654bab0e1d790d8d50b893d (diff) |
move largest bounds check to start
Change-Id: I03fe80f9568759b829fac4e9bcfd496efebe6a26
-rw-r--r-- | vcl/source/fontsubset/sft.cxx | 12 |
1 files changed, 5 insertions, 7 deletions
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index d2423c3dcc89..5f9663ae12df 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1498,19 +1498,17 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) } else if (TTCTag == T_otto) { /* PS-OpenType font */ tdoffset = 0; } else if (TTCTag == T_ttcf) { /* TrueType collection */ + if (!withinBounds(12, 4 * facenum, sizeof(sal_uInt32), t->fsize)) { + return SF_FONTNO; + } sal_uInt32 Version = GetUInt32(t->ptr, 4); if (Version != 0x00010000 && Version != 0x00020000) { return SF_TTFORMAT; } - if (!withinBounds(8, 0, sizeof(sal_uInt32), t->fsize) || facenum >= GetUInt32(t->ptr, 8)) { - return SF_FONTNO; - } - if (withinBounds(12, 4 * facenum, sizeof(sal_uInt32), t->fsize)) { - tdoffset = GetUInt32(t->ptr, 12 + 4 * facenum); - } else { + if (facenum >= GetUInt32(t->ptr, 8)) { return SF_FONTNO; } - + tdoffset = GetUInt32(t->ptr, 12 + 4 * facenum); } else { return SF_TTFORMAT; } |