diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2020-09-22 16:43:01 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2020-09-22 20:36:54 +0200 |
| commit | a7c89adaa0f205aead3c0ad43c0113ff81ba1d98 (patch) | |
| tree | d73ed42c8e0f80f9f0682fbf6178bd45e298161d /vcl/source | |
| parent | 8ea4feee03542c767e0b26beb888b63bc653878d (diff) | |
ofz#25855 overflow in nTmpOffset
we already know nLength is >= 24 so just move the calc to the other term
Change-Id: Ic52f1686ccf81e6b13d7eb7e74dbd9cb51c8ea01
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103183
Tested-by: Jenkins
Tested-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'vcl/source')
| -rw-r--r-- | vcl/source/font/fontcharmap.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/vcl/source/font/fontcharmap.cxx b/vcl/source/font/fontcharmap.cxx index d672c76c5f42..cf2c839ef8d5 100644 --- a/vcl/source/font/fontcharmap.cxx +++ b/vcl/source/font/fontcharmap.cxx @@ -153,7 +153,7 @@ bool ParseCMAP( const unsigned char* pCmap, int nLength, CmapResult& rResult ) int nTmpOffset = GetUInt( p+4 ); - if (nTmpOffset + 2 > nLength || nTmpOffset < 0) + if (nTmpOffset > nLength - 2 || nTmpOffset < 0) continue; int nTmpFormat = GetUShort( pCmap + nTmpOffset ); |