From f4e32af7450c4e6fa1063aec95ba9df49c055a3b Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Wed, 7 Feb 2018 16:05:08 +0000 Subject: stay within font bounds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: Ie8ed610b71cb1b20963827c2be97155d2d8aa22c Reviewed-on: https://gerrit.libreoffice.org/49369 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- vcl/source/fontsubset/sft.cxx | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'vcl/source/fontsubset') diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index cfad36e35f64..c61c74b672dd 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1563,7 +1563,12 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) /* parse the tables */ for (i=0; i(t->ntables); i++) { int nIndex; - tag = GetUInt32(t->ptr + tdoffset + 12, 16 * i); + const sal_uInt32 nStart = tdoffset + 12; + const sal_uInt32 nOffset = 16 * i; + if (nStart + nOffset + sizeof(sal_uInt32) <= static_cast(t->fsize)) + tag = GetUInt32(t->ptr + nStart, nOffset); + else + tag = static_cast(-1); switch( tag ) { case T_maxp: nIndex = O_maxp; break; case T_glyf: nIndex = O_glyf; break; -- cgit