From f832198e6a33052c7cc86b25843badfb962a2ae8 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Thu, 8 Feb 2018 23:57:14 +0000 Subject: move largest bounds check to start Change-Id: I03fe80f9568759b829fac4e9bcfd496efebe6a26 --- vcl/source/fontsubset/sft.cxx | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) (limited to 'vcl/source/fontsubset') diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index d2423c3dcc89..5f9663ae12df 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1498,19 +1498,17 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) } else if (TTCTag == T_otto) { /* PS-OpenType font */ tdoffset = 0; } else if (TTCTag == T_ttcf) { /* TrueType collection */ + if (!withinBounds(12, 4 * facenum, sizeof(sal_uInt32), t->fsize)) { + return SF_FONTNO; + } sal_uInt32 Version = GetUInt32(t->ptr, 4); if (Version != 0x00010000 && Version != 0x00020000) { return SF_TTFORMAT; } - if (!withinBounds(8, 0, sizeof(sal_uInt32), t->fsize) || facenum >= GetUInt32(t->ptr, 8)) { - return SF_FONTNO; - } - if (withinBounds(12, 4 * facenum, sizeof(sal_uInt32), t->fsize)) { - tdoffset = GetUInt32(t->ptr, 12 + 4 * facenum); - } else { + if (facenum >= GetUInt32(t->ptr, 8)) { return SF_FONTNO; } - + tdoffset = GetUInt32(t->ptr, 12 + 4 * facenum); } else { return SF_TTFORMAT; } -- cgit