diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-12-04 16:37:30 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-12-07 14:16:58 +0000 |
| commit | 6406a2701c3eae884e967f0b80e2e8a3228d39df (patch) | |
| tree | f30d6192f798a20baaf43279f448309568652105 /vcl/source/fontsubset | |
| parent | 9af88a70e93ff146c264c33dae60f54c926941f7 (diff) | |
coverity#1213364 Untrusted loop bound
Change-Id: I586b9550b09a485cedd13e0e4c637f253e8eafd0
Diffstat (limited to 'vcl/source/fontsubset')
| -rw-r--r-- | vcl/source/fontsubset/sft.cxx | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index bd9a1fefbc68..4085e837fa6c 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -435,8 +435,8 @@ static int GetSimpleTTOutline(TrueTypeFont *ttf, sal_uInt32 glyphID, ControlPoin /* determine the last point and be extra safe about it. But probably this code is not needed */ sal_uInt16 lastPoint=0; - sal_uInt32 nOffset = 10 + numberOfContours + 2; - if (nOffset > nTableSize) + const sal_Int32 nMaxContours = (nTableSize - 10)/2; + if (numberOfContours > nMaxContours) return 0; for (i=0; i<numberOfContours; i++) { @@ -446,7 +446,7 @@ static int GetSimpleTTOutline(TrueTypeFont *ttf, sal_uInt32 glyphID, ControlPoin } sal_uInt16 instLen = GetUInt16(ptr, 10 + numberOfContours*2, 1); - nOffset = 10 + 2 * numberOfContours + 2 + instLen; + sal_uInt32 nOffset = 10 + 2 * numberOfContours + 2 + instLen; if (nOffset > nTableSize) return 0; const sal_uInt8* p = ptr + nOffset; |