diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-02-07 16:51:32 +0000 |
|---|---|---|
| committer | Michael Stahl <Michael.Stahl@cib.de> | 2019-08-27 14:12:28 +0200 |
| commit | c843ff748780037b721b2539eb230a7f54f8f6d7 (patch) | |
| tree | 553a5e72f938de7d5be377a4fdb498c0edd39245 | |
| parent | check kern table size (diff) | |
| download | core-c843ff748780037b721b2539eb230a7f54f8f6d7.tar.gz core-c843ff748780037b721b2539eb230a7f54f8f6d7.zip | |
what matters is the availability of the last element, not the first
Change-Id: I23d3abdbe62b735d66261fb337613da88cc4206b
Reviewed-on: https://gerrit.libreoffice.org/49380
Reviewed-by: Michael Stahl <mstahl@redhat.com>
Tested-by: Michael Stahl <mstahl@redhat.com>
| -rw-r--r-- | vcl/source/fontsubset/sft.cxx | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 3378b35344e8..dfe66eb5d58c 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -2553,7 +2553,8 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, TTGlobalFontInfo *info) info->symbolEncoded = (ttf->cmapType == CMAP_MS_Symbol); const sal_uInt8* table = getTable(ttf, O_OS2); - if (table) { + sal_uInt32 table_size = getTableSize(ttf, O_OS2); + if (table && table_size >= 42) { info->weight = GetUInt16(table, 4, 1); info->width = GetUInt16(table, 6, 1); @@ -2561,12 +2562,13 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, TTGlobalFontInfo *info) * Microsoft old (78 bytes long) and Microsoft new (86 bytes long,) * Apple's documentation recommends looking at the table length. */ - if (getTableSize(ttf, O_OS2) > 68) { + if (table_size >= 78) { info->typoAscender = XUnits(UPEm,GetInt16(table, 68, 1)); info->typoDescender = XUnits(UPEm, GetInt16(table, 70, 1)); info->typoLineGap = XUnits(UPEm, GetInt16(table, 72, 1)); info->winAscent = XUnits(UPEm, GetUInt16(table, 74, 1)); info->winDescent = XUnits(UPEm, GetUInt16(table, 76, 1)); + /* sanity check; some fonts treat winDescent as signed * violating the standard */ if( info->winDescent > 5*UPEm ) |