diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2022-07-16 11:37:22 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2022-07-26 07:53:45 +0200 |
| commit | f2fea840daa769671b05773b7943c612d2afe99a (patch) | |
| tree | 757deb47cf69eed8925f4cf39ad7637f6a35ca6b /vcl/source | |
| parent | 2a81e0835c5b3ca9e937bacd4c379fd305855a3b (diff) | |
ofz#49157 Object-size
Change-Id: I3a17d7967512a282b13894ba479aa3507f1be38f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/137069
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
Diffstat (limited to 'vcl/source')
| -rw-r--r-- | vcl/source/filter/svm/SvmConverter.cxx | 25 |
1 files changed, 15 insertions, 10 deletions
diff --git a/vcl/source/filter/svm/SvmConverter.cxx b/vcl/source/filter/svm/SvmConverter.cxx index ac1592efb498..abe2193ae118 100644 --- a/vcl/source/filter/svm/SvmConverter.cxx +++ b/vcl/source/filter/svm/SvmConverter.cxx @@ -781,17 +781,22 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf ) aFontVDev->GetTextArray( aStr, &aTmpAry, nIndex, nLen ); - // now, the difference between the - // last and the second last DX array - // is the advancement for the last - // glyph. Thus, to complete our meta - // action's DX array, just add that - // difference to last elem and store - // in very last. - if( nStrLen > 1 ) - aDXAry[ nStrLen-1 ] = aDXAry[ nStrLen-2 ] + aTmpAry[ nStrLen-1 ] - aTmpAry[ nStrLen-2 ]; + if (aTmpAry.size() < o3tl::make_unsigned(nStrLen)) + SAL_WARN("vcl.gdi", "TextArray too short to recover missing element"); else - aDXAry[ nStrLen-1 ] = aTmpAry[ nStrLen-1 ]; // len=1: 0th position taken to be 0 + { + // now, the difference between the + // last and the second last DX array + // is the advancement for the last + // glyph. Thus, to complete our meta + // action's DX array, just add that + // difference to last elem and store + // in very last. + if( nStrLen > 1 ) + aDXAry[ nStrLen-1 ] = aDXAry[ nStrLen-2 ] + aTmpAry[ nStrLen-1 ] - aTmpAry[ nStrLen-2 ]; + else + aDXAry[ nStrLen-1 ] = aTmpAry[ nStrLen-1 ]; // len=1: 0th position taken to be 0 + } } #ifdef DBG_UTIL else |