diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-11-12 15:41:51 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-11-12 20:25:23 +0000 |
| commit | 703beb33b1a71a36e2b0381aa015c683323d8835 (patch) | |
| tree | 116cc5620c221e8d67202089eec21ed11f9c7c35 /vcl/source | |
| parent | 0a7b110d9ed617c9a8be15736709fe54ce18038d (diff) | |
coverity#1213370 Untrusted value as argument
Change-Id: I89e29dd0382c60b0aeadc9f664e8c2784e216f2f
Diffstat (limited to 'vcl/source')
| -rw-r--r-- | vcl/source/fontsubset/sft.cxx | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 9ee49883c6b3..3966c8ddca07 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -2648,6 +2648,17 @@ int GetTTNameRecords(TrueTypeFont *ttf, NameRecord **nr) *nr = 0; if (n == 0) return 0; + const sal_uInt32 remaining_table_size = nTableSize-6; + const sal_uInt32 nMinRecordSize = 12; + const sal_uInt32 nMaxRecords = remaining_table_size / nMinRecordSize; + if (n > nMaxRecords) + { + SAL_WARN("vcl.fonts", "Parsing error in " << OUString::createFromAscii(ttf->fname) << + ": " << nMaxRecords << " max possible entries, but " << + n << " claimed, truncating"); + n = nMaxRecords; + } + NameRecord* rec = (NameRecord*)calloc(n, sizeof(NameRecord)); for (i = 0; i < n; i++) { |