diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-02-08 17:38:59 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-02-09 10:16:01 +0000 |
| commit | bb32616bdd6e3b327654bab0e1d790d8d50b893d (patch) | |
| tree | ed4f0928e344f2984aba36f23ad7b73f2625d699 /vcl | |
| parent | c7b0117f26a386c98a721ff3897479c268103d74 (diff) | |
bounds check
Change-Id: I6d32a6b6f1dd91db42a3f154700ea55603f0e4dd
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/fontsubset/sft.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index a00fe2a7b779..d2423c3dcc89 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1502,7 +1502,7 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) if (Version != 0x00010000 && Version != 0x00020000) { return SF_TTFORMAT; } - if (facenum >= GetUInt32(t->ptr, 8)) { + if (!withinBounds(8, 0, sizeof(sal_uInt32), t->fsize) || facenum >= GetUInt32(t->ptr, 8)) { return SF_FONTNO; } if (withinBounds(12, 4 * facenum, sizeof(sal_uInt32), t->fsize)) { |