diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-02-07 16:57:27 +0000 |
|---|---|---|
| committer | Michael Stahl <Michael.Stahl@cib.de> | 2019-08-27 14:12:28 +0200 |
| commit | 8b5c5e2edc5b0a9a948ac68b01aa320cc33f2cae (patch) | |
| tree | 7bc6122e426f061c2b290b0f95c430452b9a8840 | |
| parent | sanity check cmap table size (diff) | |
| download | core-8b5c5e2edc5b0a9a948ac68b01aa320cc33f2cae.tar.gz core-8b5c5e2edc5b0a9a948ac68b01aa320cc33f2cae.zip | |
check kern table size
Change-Id: I65b5f0a8950d54c00d6fd7c385ca1c5dca2ef2c8
Reviewed-on: https://gerrit.libreoffice.org/49384
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
| -rw-r--r-- | vcl/source/fontsubset/sft.cxx | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 0d24beaf4428..3378b35344e8 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1368,7 +1368,7 @@ static void GetKern(TrueTypeFont *ttf) if( !table ) goto badtable; - if (GetUInt16(table, 0, 1) == 0) { /* Traditional Microsoft style table with sal_uInt16 version and nTables fields */ + if (nTableSize >= 4 && GetUInt16(table, 0, 1) == 0) { /* Traditional Microsoft style table with sal_uInt16 version and nTables fields */ ttf->nkern = GetUInt16(table, 2, 1); ttf->kerntype = KT_MICROSOFT; ptr = table + 4; @@ -1400,7 +1400,7 @@ static void GetKern(TrueTypeFont *ttf) return; } - if (GetUInt32(table, 0, 1) == 0x00010000) { /* MacOS style kern tables: fixed32 version and sal_uInt32 nTables fields */ + if (nTableSize >= 8 && GetUInt32(table, 0, 1) == 0x00010000) { /* MacOS style kern tables: fixed32 version and sal_uInt32 nTables fields */ ttf->nkern = GetUInt32(table, 4, 1); ttf->kerntype = KT_APPLE_NEW; ptr = table + 8; |