summaryrefslogtreecommitdiff
path: root/vcl/source
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2018-02-07 15:50:35 +0000
committerCaolán McNamara <caolanm@redhat.com>2018-02-09 14:59:34 +0100
commit38666ba87c8f71032b237e89742b52a21b73ad51 (patch)
treef50ce712f885f92148693f2fd4b570e9638a5700 /vcl/source
parentac09d2fe176fe936d3056b94c07869cfd45e698f (diff)
check O_head size
Change-Id: Idf5d30eaed0196cfa9266e35131c538c606a0960 Reviewed-on: https://gerrit.libreoffice.org/49365 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit b10ae2faae6f3c448bbab71585550387e18cc248) Reviewed-on: https://gerrit.libreoffice.org/49366 Reviewed-by: Michael Stahl <mstahl@redhat.com>
Diffstat (limited to 'vcl/source')
-rw-r--r--vcl/source/fontsubset/sft.cxx8
1 files changed, 6 insertions, 2 deletions
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 74bf0ff307f1..10764a263907 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1450,7 +1450,6 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
int i;
sal_uInt32 length, tag;
sal_uInt32 tdoffset = 0; /* offset to TableDirectory in a TTC file. For TTF files is 0 */
- int indexfmt;
sal_uInt32 TTCTag = GetInt32(t->ptr, 0);
@@ -1590,8 +1589,13 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
t->nglyphs = table_size >= 6 ? GetUInt16(table, 4) : 0;
table = getTable(t, O_head);
+ table_size = getTableSize(t, O_head);
+ if (table_size < 52) {
+ CloseTTFont(t);
+ return SF_TTFORMAT;
+ }
t->unitsPerEm = GetUInt16(table, 18);
- indexfmt = GetInt16(table, 50);
+ int indexfmt = GetInt16(table, 50);
if( ((indexfmt != 0) && (indexfmt != 1)) || (t->unitsPerEm <= 0) ) {
CloseTTFont(t);