forcepoint#53 restrict to expected index range

Change-Id: I22f01e5a3e3cf51b014ac841cd14071dce5baf0f
Reviewed-on: https://gerrit.libreoffice.org/57922
Tested-by: Jenkins
Reviewed-by: Eike Rathke <erack@redhat.com>
(cherry picked from commit fa82b6a5c74b527dc2aed9d3b63c997580cdb277)
(cherry picked from commit d0f42b02c29c1e6aeeaa13d5f0d4a2e8b5ccb881)

1 files changed, 7 insertions, 2 deletions

diff --git a/vcl/source/gdi/CommonSalLayout.cxx b/vcl/source/gdi/CommonSalLayout.cxx
index 0cf7e01ce992..6361be2f68e6 100644
--- a/vcl/source/gdi/CommonSalLayout.cxx
+++ b/vcl/source/gdi/CommonSalLayout.cxx
@@ -702,13 +702,18 @@ bool CommonSalLayout::LayoutText(ImplLayoutArgs& rArgs)
 
 bool CommonSalLayout::GetCharWidths(DeviceCoordinate* pCharWidths) const
 {
-    int nCharCount = mnEndCharPos - mnMinCharPos;
+    const int nCharCount = mnEndCharPos - mnMinCharPos;
 
     for (int i = 0; i < nCharCount; ++i)
         pCharWidths[i] = 0;
 
     for (auto const& aGlyphItem : m_GlyphItems)
-        pCharWidths[aGlyphItem.mnCharPos - mnMinCharPos] += aGlyphItem.mnNewWidth;
+    {
+        const int nIndex = aGlyphItem.mnCharPos - mnMinCharPos;
+        if (nIndex >= nCharCount)
+            continue;
+        pCharWidths[nIndex] += aGlyphItem.mnNewWidth;
+    }
 
     return true;
 }