From dd7f4acfccee6fd845050ecdc5544c1c9c78afaf Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Thu, 3 Mar 2022 09:26:18 +0000
Subject: ofz: Use-of-uninitialized-value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I358d826a1dafe345f610d26d0d517a7357c838d2
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130909
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
---
 vcl/source/fontsubset/sft.cxx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'vcl')

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index a413c73e7bd0..9ce05ebe0e30 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -379,7 +379,11 @@ static int GetSimpleTTOutline(AbstractTrueTypeFont const *ttf, sal_uInt32 glyphI
             lastPoint = t;
     }
 
-    sal_uInt16 instLen = GetUInt16(ptr, 10 + numberOfContours*2);
+    sal_uInt32 nInstLenOffset = 10 + numberOfContours * 2;
+    if (nInstLenOffset + 2 > nMaxGlyphSize)
+        return 0;
+    sal_uInt16 instLen = GetUInt16(ptr, nInstLenOffset);
+
     sal_uInt32 nOffset = 10 + 2 * numberOfContours + 2 + instLen;
     if (nOffset > nMaxGlyphSize)
         return 0;
-- 
cgit