From 6a5dd482375b04f9c4d3735b3ba178ccddc71b32 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Mon, 28 Feb 2022 21:12:07 +0000 Subject: ofz: measure maximum possible contours Change-Id: Ie039abd835fef06514edde12b99e17360f5481a5 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130773 Reviewed-by: Michael Stahl Tested-by: Jenkins --- vcl/source/fontsubset/sft.cxx | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'vcl') diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index de691ad715c1..6ed347bc6388 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -347,7 +347,13 @@ static int GetSimpleTTOutline(AbstractTrueTypeFont const *ttf, sal_uInt32 glyphI if (glyphID >= ttf->glyphCount()) return 0; - const sal_uInt8* ptr = table + ttf->glyphOffset(glyphID); + sal_uInt32 nGlyphOffset = ttf->glyphOffset(glyphID); + if (nGlyphOffset > nTableSize) + return 0; + + const sal_uInt8* ptr = table + nGlyphOffset; + const sal_uInt32 nMaxGlyphSize = nTableSize - nGlyphOffset; + const sal_Int16 numberOfContours = GetInt16(ptr, GLYF_numberOfContours_offset); if( numberOfContours <= 0 ) /*- glyph is not simple */ return 0; @@ -362,7 +368,7 @@ static int GetSimpleTTOutline(AbstractTrueTypeFont const *ttf, sal_uInt32 glyphI /* determine the last point and be extra safe about it. But probably this code is not needed */ sal_uInt16 lastPoint=0; - const sal_Int32 nMaxContours = (nTableSize - 10)/2; + const sal_Int32 nMaxContours = (nMaxGlyphSize - 10)/2; if (numberOfContours > nMaxContours) return 0; for (i=0; i