From a6eaacf66ccc8f83b075b775f4dfa0aace0c3e3a Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Mon, 22 Jul 2019 09:13:14 +0100 Subject: cid#1209863 Untrusted loop bound MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: Ie9c3672a065b9df4580559cd927c6b1524edde0e Reviewed-on: https://gerrit.libreoffice.org/76099 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- vcl/source/font/fontcharmap.cxx | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'vcl/source/font/fontcharmap.cxx') diff --git a/vcl/source/font/fontcharmap.cxx b/vcl/source/font/fontcharmap.cxx index ade991626dd9..78c1c7112d09 100644 --- a/vcl/source/font/fontcharmap.cxx +++ b/vcl/source/font/fontcharmap.cxx @@ -231,9 +231,20 @@ bool ParseCMAP( const unsigned char* pCmap, int nLength, CmapResult& rResult ) else if( (nFormat == 12) && ((nOffset+16) < nLength) ) { nRangeCount = GetUInt( pCmap + nOffset + 12 ); + + const int nGroupOffset = nOffset + 16; + const int nRemainingLen = nLength - nGroupOffset; + const int nMaxPossiblePairs = nRemainingLen / 12; + if (nRangeCount > nMaxPossiblePairs) + { + SAL_WARN("vcl.gdi", "more code pairs requested then space available"); + nRangeCount = nMaxPossiblePairs; + } + pCodePairs = new sal_UCS4[ nRangeCount * 2 ]; pStartGlyphs = new int[ nRangeCount ]; - const unsigned char* pGroup = pCmap + nOffset + 16; + + const unsigned char* pGroup = pCmap + nGroupOffset; sal_UCS4* pCP = pCodePairs; for( int i = 0; i < nRangeCount; ++i ) { -- cgit