diff options
| author | hdu <duerr@sun.com> | 2009-12-01 10:37:14 +0100 |
|---|---|---|
| committer | hdu <duerr@sun.com> | 2009-12-01 10:37:14 +0100 |
| commit | 8e1696a1e3402f66342d590733a9afdbe4ea840b (patch) | |
| tree | 987b31b590d4d81714ddb24ebd381805b214d0c7 /vcl/source/glyphs/gcach_ftyp.cxx | |
| parent | dc5c1da812d3feecd465cf81506d1bea82b7c6c8 (diff) | |
#i106264# prevent ushort-overflow in GSUB.cov2
Diffstat (limited to 'vcl/source/glyphs/gcach_ftyp.cxx')
| -rw-r--r-- | vcl/source/glyphs/gcach_ftyp.cxx | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/vcl/source/glyphs/gcach_ftyp.cxx b/vcl/source/glyphs/gcach_ftyp.cxx index 18857b94af8f..b724893e139c 100644 --- a/vcl/source/glyphs/gcach_ftyp.cxx +++ b/vcl/source/glyphs/gcach_ftyp.cxx @@ -2487,14 +2487,12 @@ bool FreetypeServerFont::ApplyGSUB( const ImplFontSelectData& rFSD ) pCoverage += 2; for( int i = nCntRange; --i >= 0; ) { - const USHORT nGlyph0 = GetUShort( pCoverage+0 ); - const USHORT nGlyph1 = GetUShort( pCoverage+2 ); - const USHORT nStartCoverageIndex = GetUShort( pCoverage+4 ); - DBG_ASSERT( aSubstVector.size() == nStartCoverageIndex, "coverage index mismatch"); - (void)nStartCoverageIndex; + const UINT32 nGlyph0 = GetUShort( pCoverage+0 ); + const UINT32 nGlyph1 = GetUShort( pCoverage+2 ); + const USHORT nCovIdx = GetUShort( pCoverage+4 ); pCoverage += 6; - for( USHORT j = nGlyph0; j <= nGlyph1; ++j ) - aSubstVector.push_back( GlyphSubst( j, 0 ) ); + for( UINT32 j = nGlyph0; j <= nGlyph1; ++j ) + aSubstVector.push_back( GlyphSubst( static_cast<USHORT>(j + nCovIdx), 0 ) ); } } break; @@ -2538,3 +2536,4 @@ bool FreetypeServerFont::ApplyGSUB( const ImplFontSelectData& rFSD ) } // ======================================================================= + |