[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara]

 vcl/source/fontsubset/sft.cxx |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

New commits:
commit b10ae2faae6f3c448bbab71585550387e18cc248
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 7 15:50:35 2018 +0000

    check O_head size
    
    Change-Id: Idf5d30eaed0196cfa9266e35131c538c606a0960
    Reviewed-on: https://gerrit.libreoffice.org/49365
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 48326e11c0f0..3071bd5dee1c 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1524,7 +1524,6 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
     int i;
     sal_uInt32 length, tag;
     sal_uInt32 tdoffset = 0;        /* offset to TableDirectory in a TTC file. For TTF files is 0 */
-    int indexfmt;
 
     sal_uInt32 TTCTag = GetInt32(t->ptr, 0);
 
@@ -1660,8 +1659,13 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
     t->nglyphs = table_size >= 6 ? GetUInt16(table, 4) : 0;
 
     table = getTable(t, O_head);
+    table_size = getTableSize(t, O_head);
+    if (table_size < 52) {
+        CloseTTFont(t);
+        return SF_TTFORMAT;
+    }
     t->unitsPerEm = GetUInt16(table, 18);
-    indexfmt = GetInt16(table, 50);
+    int indexfmt = GetInt16(table, 50);
 
     if( ((indexfmt != 0) && (indexfmt != 1)) || (t->unitsPerEm <= 0) ) {
         CloseTTFont(t);