coverity#1213364 Untrusted loop bound

Change-Id: I518c4819fd4efe605dab0e73c58f8a8c7691b26d

1 files changed, 6 insertions, 3 deletions

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 545222a0b152..bd9a1fefbc68 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -435,15 +435,18 @@ static int GetSimpleTTOutline(TrueTypeFont *ttf, sal_uInt32 glyphID, ControlPoin
 
     /* determine the last point and be extra safe about it. But probably this code is not needed */
     sal_uInt16 lastPoint=0;
-    for (i=0; i<numberOfContours; i++) {
+    sal_uInt32 nOffset = 10 + numberOfContours + 2;
+    if (nOffset > nTableSize)
+        return 0;
+    for (i=0; i<numberOfContours; i++)
+    {
         const sal_uInt16 t = GetUInt16(ptr, 10+i*2, 1);
         if (t > lastPoint)
             lastPoint = t;
     }
 
     sal_uInt16 instLen = GetUInt16(ptr, 10 + numberOfContours*2, 1);
-
-    const sal_uInt32 nOffset = 10 + 2 * numberOfContours + 2 + instLen;
+    nOffset = 10 + 2 * numberOfContours + 2 + instLen;
     if (nOffset > nTableSize)
         return 0;
     const sal_uInt8* p = ptr + nOffset;