From b10ae2faae6f3c448bbab71585550387e18cc248 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Wed, 7 Feb 2018 15:50:35 +0000 Subject: check O_head size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: Idf5d30eaed0196cfa9266e35131c538c606a0960 Reviewed-on: https://gerrit.libreoffice.org/49365 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- vcl/source/fontsubset/sft.cxx | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'vcl') diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 48326e11c0f0..3071bd5dee1c 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1524,7 +1524,6 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) int i; sal_uInt32 length, tag; sal_uInt32 tdoffset = 0; /* offset to TableDirectory in a TTC file. For TTF files is 0 */ - int indexfmt; sal_uInt32 TTCTag = GetInt32(t->ptr, 0); @@ -1660,8 +1659,13 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) t->nglyphs = table_size >= 6 ? GetUInt16(table, 4) : 0; table = getTable(t, O_head); + table_size = getTableSize(t, O_head); + if (table_size < 52) { + CloseTTFont(t); + return SF_TTFORMAT; + } t->unitsPerEm = GetUInt16(table, 18); - indexfmt = GetInt16(table, 50); + int indexfmt = GetInt16(table, 50); if( ((indexfmt != 0) && (indexfmt != 1)) || (t->unitsPerEm <= 0) ) { CloseTTFont(t); -- cgit v1.2.3