vcl/source/filter/svm/SvmConverter.cxx | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
New commits:
commit 2ad6beb1dff9a2e4e864831fdfc2c9c058506944
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sat Jul 16 11:37:22 2022 +0100
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Sat Jul 16 15:19:10 2022 +0200
ofz#49157 Object-size
Change-Id: I3a17d7967512a282b13894ba479aa3507f1be38f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/137121
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
diff --git a/vcl/source/filter/svm/SvmConverter.cxx
b/vcl/source/filter/svm/SvmConverter.cxx
index c22b41b236b0..2e7ed8f35c26 100644
--- a/vcl/source/filter/svm/SvmConverter.cxx
+++ b/vcl/source/filter/svm/SvmConverter.cxx
@@ -782,17 +782,22 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm,
GDIMetaFile& rMtf )
aFontVDev->GetTextArray( aStr, &aTmpAry,
nIndex, nLen );
- // now, the difference between the
- // last and the second last DX array
- // is the advancement for the last
- // glyph. Thus, to complete our meta
- // action's DX array, just add that
- // difference to last elem and store
- // in very last.
- if( nStrLen > 1 )
- aDXAry[ nStrLen-1 ] = aDXAry[
nStrLen-2 ] + aTmpAry[ nStrLen-1 ] - aTmpAry[ nStrLen-2 ];
+ if (aTmpAry.size() <
o3tl::make_unsigned(nStrLen))
+ SAL_WARN("vcl.gdi", "TextArray too
short to recover missing element");
else
- aDXAry[ nStrLen-1 ] = aTmpAry[
nStrLen-1 ]; // len=1: 0th position taken to be 0
+ {
+ // now, the difference between the
+ // last and the second last DX array
+ // is the advancement for the last
+ // glyph. Thus, to complete our meta
+ // action's DX array, just add that
+ // difference to last elem and store
+ // in very last.
+ if( nStrLen > 1 )
+ aDXAry[ nStrLen-1 ] = aDXAry[
nStrLen-2 ] + aTmpAry[ nStrLen-1 ] - aTmpAry[ nStrLen-2 ];
+ else
+ aDXAry[ nStrLen-1 ] = aTmpAry[
nStrLen-1 ]; // len=1: 0th position taken to be 0
+ }
}
#ifdef DBG_UTIL
else
