diff options
| -rw-r--r-- | vcl/source/fontsubset/sft.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index a00fe2a7b779..d2423c3dcc89 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1502,7 +1502,7 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) if (Version != 0x00010000 && Version != 0x00020000) { return SF_TTFORMAT; } - if (facenum >= GetUInt32(t->ptr, 8)) { + if (!withinBounds(8, 0, sizeof(sal_uInt32), t->fsize) || facenum >= GetUInt32(t->ptr, 8)) { return SF_FONTNO; } if (withinBounds(12, 4 * facenum, sizeof(sal_uInt32), t->fsize)) { |