[Libreoffice-commits] core.git: Branch 'libreoffice-7-3' - vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/fontsubset/sft.cxx |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

New commits:
commit 8f4e7b39092252646dae61488f35a500398c043f
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Feb 28 21:12:07 2022 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Wed Mar 2 09:41:57 2022 +0100

    ofz: measure maximum possible contours
    
    Change-Id: Ie039abd835fef06514edde12b99e17360f5481a5
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130773
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    Tested-by: Jenkins

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index de691ad715c1..6ed347bc6388 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -347,7 +347,13 @@ static int GetSimpleTTOutline(AbstractTrueTypeFont const 
*ttf, sal_uInt32 glyphI
     if (glyphID >= ttf->glyphCount())
         return 0;
 
-    const sal_uInt8* ptr = table + ttf->glyphOffset(glyphID);
+    sal_uInt32 nGlyphOffset = ttf->glyphOffset(glyphID);
+    if (nGlyphOffset > nTableSize)
+        return 0;
+
+    const sal_uInt8* ptr = table + nGlyphOffset;
+    const sal_uInt32 nMaxGlyphSize = nTableSize - nGlyphOffset;
+
     const sal_Int16 numberOfContours = GetInt16(ptr, 
GLYF_numberOfContours_offset);
     if( numberOfContours <= 0 )             /*- glyph is not simple */
         return 0;
@@ -362,7 +368,7 @@ static int GetSimpleTTOutline(AbstractTrueTypeFont const 
*ttf, sal_uInt32 glyphI
 
     /* determine the last point and be extra safe about it. But probably this 
code is not needed */
     sal_uInt16 lastPoint=0;
-    const sal_Int32 nMaxContours = (nTableSize - 10)/2;
+    const sal_Int32 nMaxContours = (nMaxGlyphSize - 10)/2;
     if (numberOfContours > nMaxContours)
         return 0;
     for (i=0; i<numberOfContours; i++)