[Libreoffice-commits] core.git: 2 commits - vcl/source

[David Tardon]

 vcl/source/fontsubset/sft.cxx |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

New commits:
commit 06efeee90c6347c4f136fe057188ac04f40a0bb9
Author: David Tardon <dtardon at redhat.com>
Date:   Fri Nov 14 13:17:07 2014 +0100

    use already existing variable
    
    Change-Id: I3f2781e2a041845e732046ea591a15c9bb21f1a5

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 13da74b..b694520f5 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1096,7 +1096,7 @@ static sal_uInt32 getGlyph2(const sal_uInt8 *cmap, const sal_uInt32 nMaxCmapSize
             sal_uInt16* const pGlyph = (&(subHeader2s[0].idRangeOffset))
                      + (Int16FromMOTA(subHeader2s[0].idRangeOffset)/2)             /* + offset        */
                      + theLowByte                                                  /* + to_look       */
-                     - Int16FromMOTA(subHeader2s[0].firstCode)
+                     - firstCode
                      ;
             if (reinterpret_cast<sal_uInt8*>(pGlyph) - cmap < int(nMaxCmapSize) - 4)
                 return *pGlyph;
commit e164eb5c85547a49c0bcbdbdf1b1cdc9726f3133
Author: David Tardon <dtardon at redhat.com>
Date:   Fri Nov 14 13:16:40 2014 +0100

    coverity#1251174 untrusted pointer read
    
    Change-Id: I894fc64d6ae6881347bd1379d2934654536a01cf

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index b512b12..13da74b 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1093,11 +1093,15 @@ static sal_uInt32 getGlyph2(const sal_uInt8 *cmap, const sal_uInt32 nMaxCmapSize
     if(k == 0) {
         firstCode = Int16FromMOTA(subHeader2s[k].firstCode);
         if(theLowByte >= firstCode && theLowByte < (firstCode + Int16FromMOTA(subHeader2s[k].entryCount))) {
-            return *((&(subHeader2s[0].idRangeOffset))
+            sal_uInt16* const pGlyph = (&(subHeader2s[0].idRangeOffset))
                      + (Int16FromMOTA(subHeader2s[0].idRangeOffset)/2)             /* + offset        */
                      + theLowByte                                                  /* + to_look       */
                      - Int16FromMOTA(subHeader2s[0].firstCode)
-                     );
+                     ;
+            if (reinterpret_cast<sal_uInt8*>(pGlyph) - cmap < int(nMaxCmapSize) - 4)
+                return *pGlyph;
+            else
+                return MISSING_GLYPH_INDEX;
         } else {
             return MISSING_GLYPH_INDEX;
         }