diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-02-07 16:44:43 +0000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2018-03-06 15:20:56 +0100 |
| commit | 645c773e540623ce1f4d4fc5acd79cd150096f5d (patch) | |
| tree | 9725d1421967dc32ead64f52e6a99e53213b2d68 | |
| parent | check table size before reading nglyphs (diff) | |
| download | core-645c773e540623ce1f4d4fc5acd79cd150096f5d.tar.gz core-645c773e540623ce1f4d4fc5acd79cd150096f5d.zip | |
check O_hhea and O_vhea sizes
Change-Id: I82e47732815f0112801c8c3a3e5b0b09ac25610a
Reviewed-on: https://gerrit.libreoffice.org/49439
Reviewed-by: Michael Stahl <mstahl@redhat.com>
Tested-by: Jenkins <ci@libreoffice.org>
(cherry picked from commit e3308146244efb1985e1d84a5ddfb8ac1754d5c5)
| -rw-r--r-- | vcl/source/fontsubset/sft.cxx | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 11620beda5ae..2a47232e34d7 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1535,8 +1535,10 @@ int OpenTTFontBuffer(const void* pBuffer, sal_uInt32 nLen, sal_uInt32 facenum, T static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) { - if (t->fsize < 4) + if (t->fsize < 4) { + CloseTTFont(t); return SF_TTFORMAT; + } int i; sal_uInt32 length, tag; sal_uInt32 tdoffset = 0; /* offset to TableDirectory in a TTC file. For TTF files is 0 */ @@ -1717,10 +1719,12 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) } table = getTable(t, O_hhea); - t->numberOfHMetrics = (table != nullptr) ? GetUInt16(table, 34) : 0; + table_size = getTableSize(t, O_hhea); + t->numberOfHMetrics = (table && table_size >= 36) ? GetUInt16(table, 34) : 0; table = getTable(t, O_vhea); - t->numOfLongVerMetrics = (table != nullptr) ? GetUInt16(table, 34) : 0; + table_size = getTableSize(t, O_vhea); + t->numOfLongVerMetrics = (table && table_size >= 36) ? GetUInt16(table, 34) : 0; GetNames(t); FindCmap(t); |