vcl/source/font/fontcharmap.cxx | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
New commits:
commit fb733dea0c172c8a692cf66f66c5457591be314a
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Fri Sep 18 19:33:15 2020 +0100
Commit: Michael Stahl <michael.st...@cib.de>
CommitDate: Mon Sep 21 12:12:28 2020 +0200
ofz#25774 keep ParseCMAP within legal area
Change-Id: Ic68fadd3d63631cbccda76e7679d95bb89452d25
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/102944
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@cib.de>
diff --git a/vcl/source/font/fontcharmap.cxx b/vcl/source/font/fontcharmap.cxx
index 9ba392935c60..5e83e19cefb1 100644
--- a/vcl/source/font/fontcharmap.cxx
+++ b/vcl/source/font/fontcharmap.cxx
@@ -189,12 +189,23 @@ bool ParseCMAP( const unsigned char* pCmap, int nLength,
CmapResult& rResult )
nRangeCount = 0;
}
- pCodePairs = new sal_UCS4[ nRangeCount * 2 ];
- pStartGlyphs = new int[ nRangeCount ];
const unsigned char* pLimitBase = pCmap + nOffset + 14;
const unsigned char* pBeginBase = pLimitBase + nSegCountX2 + 2;
const unsigned char* pDeltaBase = pBeginBase + nSegCountX2;
const unsigned char* pOffsetBase = pDeltaBase + nSegCountX2;
+
+ const int nOffsetBaseStart = pOffsetBase - pCmap;
+ const int nRemainingLen = nLength - nOffsetBaseStart;
+ const int nMaxPossibleRangeOffsets = nRemainingLen / 2;
+ if (nRangeCount > nMaxPossibleRangeOffsets)
+ {
+ SAL_WARN("vcl.gdi", "more range offsets requested then space
available");
+ nRangeCount = std::max(0, nMaxPossibleRangeOffsets);
+ }
+
+ pCodePairs = new sal_UCS4[ nRangeCount * 2 ];
+ pStartGlyphs = new int[ nRangeCount ];
+
sal_UCS4* pCP = pCodePairs;
for( int i = 0; i < nRangeCount; ++i )
{
@@ -254,7 +265,7 @@ bool ParseCMAP( const unsigned char* pCmap, int nLength,
CmapResult& rResult )
if (nRangeCount > nMaxPossiblePairs)
{
SAL_WARN("vcl.gdi", "more code pairs requested then space
available");
- nRangeCount = nMaxPossiblePairs;
+ nRangeCount = std::max(0, nMaxPossiblePairs);
}
pCodePairs = new sal_UCS4[ nRangeCount * 2 ];
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
