diff options
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/fontsubset/sft.cxx | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index a413c73e7bd0..9ce05ebe0e30 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -379,7 +379,11 @@ static int GetSimpleTTOutline(AbstractTrueTypeFont const *ttf, sal_uInt32 glyphI lastPoint = t; } - sal_uInt16 instLen = GetUInt16(ptr, 10 + numberOfContours*2); + sal_uInt32 nInstLenOffset = 10 + numberOfContours * 2; + if (nInstLenOffset + 2 > nMaxGlyphSize) + return 0; + sal_uInt16 instLen = GetUInt16(ptr, nInstLenOffset); + sal_uInt32 nOffset = 10 + 2 * numberOfContours + 2 + instLen; if (nOffset > nMaxGlyphSize) return 0; |