[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara]

 vcl/source/fontsubset/sft.cxx |    6 ++++++
 1 file changed, 6 insertions(+)

New commits:
commit bb5faa16aa61a927eea3507eeeb7a35ec1c7a7b7
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 7 12:29:32 2018 +0000

    sanity check cmap table size
    
    Change-Id: I010c2fd221bcd86a62efd9996a0c34930828cb6d
    Reviewed-on: https://gerrit.libreoffice.org/49348
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 58cfb6a57e1d..21ffb3c13255 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1225,6 +1225,12 @@ static void FindCmap(TrueTypeFont *ttf)
 {
     const sal_uInt8* table = getTable(ttf, O_cmap);
     sal_uInt32 table_size = getTableSize(ttf, O_cmap);
+    if (table_size < 4)
+    {
+        SAL_WARN("vcl.fonts", "Parsing error in " << OUString::createFromAscii(ttf->fname) <<
+                 "cmap table size too short");
+        return;
+    }
     sal_uInt16 ncmaps = GetUInt16(table, 2);
     sal_uInt32 AppleUni   = 0;              // Apple Unicode
     sal_uInt32 ThreeZero  = 0;              /* MS Symbol            */