what matters is the availability of the last element, not the first

Change-Id: I23d3abdbe62b735d66261fb337613da88cc4206b
Reviewed-on: https://gerrit.libreoffice.org/49378
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 3 insertions, 2 deletions

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 1b77d7ec7142..76367cbc43ae 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -2440,7 +2440,8 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, TTGlobalFontInfo *info)
     info->symbolEncoded = (ttf->cmapType == CMAP_MS_Symbol);
 
     const sal_uInt8* table = getTable(ttf, O_OS2);
-    if (table) {
+    sal_uInt32 table_size = getTableSize(ttf, O_OS2);
+    if (table && table_size >= 42) {
         info->weight = GetUInt16(table, 4);
         info->width  = GetUInt16(table, 6);
 
@@ -2448,7 +2449,7 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, TTGlobalFontInfo *info)
          * Microsoft old (78 bytes long) and Microsoft new (86 bytes long,)
          * Apple's documentation recommends looking at the table length.
          */
-        if (getTableSize(ttf, O_OS2) > 68) {
+        if (table_size >= 78) {
             info->typoAscender = XUnits(UPEm,GetInt16(table, 68));
             info->typoDescender = XUnits(UPEm, GetInt16(table, 70));
             info->typoLineGap = XUnits(UPEm, GetInt16(table, 72));