diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2022-03-03 20:28:28 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2022-03-03 22:16:50 +0100 |
| commit | dd6ff950cbc570a11100a7cce69d51577a26bbd7 (patch) | |
| tree | 1d4b6cce1feb17814a5012d57a80622b1509167b /vcl | |
| parent | dd7f4acfccee6fd845050ecdc5544c1c9c78afaf (diff) | |
ofz: Use-of-uninitialized-value
Change-Id: If10e8d2465ef6de62583f6547e3f68e92002f3f8
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130944
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/fontsubset/sft.cxx | 29 |
1 files changed, 22 insertions, 7 deletions
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 9ce05ebe0e30..794cdd59d7f8 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1521,31 +1521,46 @@ int GetTTGlyphComponents(AbstractTrueTypeFont *ttf, sal_uInt32 glyphID, std::vec glyphlist.push_back( glyphID ); - const sal_uInt32 nMaxGlyphSize = glyflength - nOffset; + sal_uInt32 nRemainingData = glyflength - nOffset; - if (nMaxGlyphSize >= 10 && GetInt16(ptr, 0) == -1) { + if (nRemainingData >= 10 && GetInt16(ptr, 0) == -1) { sal_uInt16 flags, index; ptr += 10; + nRemainingData -= 10; do { + if (nRemainingData < 4) + { + SAL_WARN("vcl.fonts", "short read"); + break; + } flags = GetUInt16(ptr, 0); index = GetUInt16(ptr, 2); ptr += 4; + nRemainingData -= 4; n += GetTTGlyphComponents(ttf, index, glyphlist); + sal_uInt32 nAdvance; if (flags & ARG_1_AND_2_ARE_WORDS) { - ptr += 4; + nAdvance = 4; } else { - ptr += 2; + nAdvance = 2; } if (flags & WE_HAVE_A_SCALE) { - ptr += 2; + nAdvance += 2; } else if (flags & WE_HAVE_AN_X_AND_Y_SCALE) { - ptr += 4; + nAdvance += 4; } else if (flags & WE_HAVE_A_TWO_BY_TWO) { - ptr += 8; + nAdvance += 8; + } + if (nRemainingData < nAdvance) + { + SAL_WARN("vcl.fonts", "short read"); + break; } + ptr += nAdvance; + nRemainingData -= nAdvance; } while (flags & MORE_COMPONENTS); } |