From 093ed85875331f57ba32b382f0efa211f36e5abe Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 28 Nov 2014 17:05:38 +0000
Subject: coverity#1213364 Untrusted loop bound
Change-Id: I518c4819fd4efe605dab0e73c58f8a8c7691b26d
---
vcl/source/fontsubset/sft.cxx | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
(limited to 'vcl')
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 545222a0b152..bd9a1fefbc68 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -435,15 +435,18 @@ static int GetSimpleTTOutline(TrueTypeFont *ttf, sal_uInt32 glyphID, ControlPoin
/* determine the last point and be extra safe about it. But probably this code is not needed */
sal_uInt16 lastPoint=0;
- for (i=0; i<numberOfContours; i++) {
+ sal_uInt32 nOffset = 10 + numberOfContours + 2;
+ if (nOffset > nTableSize)
+ return 0;
+ for (i=0; i<numberOfContours; i++)
+ {
const sal_uInt16 t = GetUInt16(ptr, 10+i*2, 1);
if (t > lastPoint)
lastPoint = t;
}
sal_uInt16 instLen = GetUInt16(ptr, 10 + numberOfContours*2, 1);
-
- const sal_uInt32 nOffset = 10 + 2 * numberOfContours + 2 + instLen;
+ nOffset = 10 + 2 * numberOfContours + 2 + instLen;
if (nOffset > nTableSize)
return 0;
const sal_uInt8* p = ptr + nOffset;
--
cgit