[Libreoffice-commits] core.git: Branch 'libreoffice-7-3' - vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/fontsubset/sft.cxx |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit 1e9146eb41d6ab665d179ccbc8a40cfc1fbba299
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Thu Mar 3 09:26:18 2022 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Thu Mar 3 16:16:51 2022 +0100

    ofz: Use-of-uninitialized-value
    
    Change-Id: I358d826a1dafe345f610d26d0d517a7357c838d2
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130853
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    Tested-by: Jenkins

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index ef483bdfcbe2..9655668c20a3 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -378,7 +378,11 @@ static int GetSimpleTTOutline(AbstractTrueTypeFont const 
*ttf, sal_uInt32 glyphI
             lastPoint = t;
     }
 
-    sal_uInt16 instLen = GetUInt16(ptr, 10 + numberOfContours*2);
+    sal_uInt32 nInstLenOffset = 10 + numberOfContours * 2;
+    if (nInstLenOffset + 2 > nMaxGlyphSize)
+        return 0;
+    sal_uInt16 instLen = GetUInt16(ptr, nInstLenOffset);
+
     sal_uInt32 nOffset = 10 + 2 * numberOfContours + 2 + instLen;
     if (nOffset > nMaxGlyphSize)
         return 0;