coverity#1222238 Untrusted loop bound

Change-Id: I1a4dec8727d0a27f7fd0396fd22d955f61daaee4

1 files changed, 8 insertions, 0 deletions

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index f0d1007d6477..cc13d172e3a8 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -2045,6 +2045,14 @@ static GlyphOffsets *GlyphOffsetsNew(sal_uInt8 *sfntP, sal_uInt32 sfntLen)
     sal_uInt32 locaLen = 0;
     sal_Int16 indexToLocFormat = 0;
 
+    sal_uInt32 nMaxPossibleTables = sfntLen / (3*sizeof(sal_uInt32)); /*the three GetUInt32 calls*/
+    if (numTables > nMaxPossibleTables)
+    {
+        SAL_WARN( "vcl.fonts", "GlyphOffsetsNew claimed to have "
+            << numTables  << " tables, but that's impossibly large");
+        numTables = nMaxPossibleTables;
+    }
+
     for (i = 0; i < numTables; i++) {
         sal_uInt32 nLargestFixedOffsetPos = 12 + 16 * i + 12;
         sal_uInt32 nMinSize = nLargestFixedOffsetPos + sizeof(sal_uInt32);