diff options
| author | David Tardon <dtardon@redhat.com> | 2014-11-14 13:16:40 +0100 |
|---|---|---|
| committer | David Tardon <dtardon@redhat.com> | 2014-11-17 14:50:18 +0100 |
| commit | e164eb5c85547a49c0bcbdbdf1b1cdc9726f3133 (patch) | |
| tree | 01f3e621966ee128370a0b3ec3850ab78be79fa8 /vcl | |
| parent | 71fae5db27255fb51a25a307205a8fe76cc56b6a (diff) | |
coverity#1251174 untrusted pointer read
Change-Id: I894fc64d6ae6881347bd1379d2934654536a01cf
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/fontsubset/sft.cxx | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index b512b12ff790..13da74bca567 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1093,11 +1093,15 @@ static sal_uInt32 getGlyph2(const sal_uInt8 *cmap, const sal_uInt32 nMaxCmapSize if(k == 0) { firstCode = Int16FromMOTA(subHeader2s[k].firstCode); if(theLowByte >= firstCode && theLowByte < (firstCode + Int16FromMOTA(subHeader2s[k].entryCount))) { - return *((&(subHeader2s[0].idRangeOffset)) + sal_uInt16* const pGlyph = (&(subHeader2s[0].idRangeOffset)) + (Int16FromMOTA(subHeader2s[0].idRangeOffset)/2) /* + offset */ + theLowByte /* + to_look */ - Int16FromMOTA(subHeader2s[0].firstCode) - ); + ; + if (reinterpret_cast<sal_uInt8*>(pGlyph) - cmap < int(nMaxCmapSize) - 4) + return *pGlyph; + else + return MISSING_GLYPH_INDEX; } else { return MISSING_GLYPH_INDEX; } |