[Libreoffice-commits] core.git: Branch 'libreoffice-5-4' - vcl/source

[Caolán McNamara]

 vcl/source/fontsubset/sft.cxx |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit d566c200995d2124fb76adc9484cb8ef58ab78ae
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 7 16:57:27 2018 +0000

    check kern table size
    
    Change-Id: I65b5f0a8950d54c00d6fd7c385ca1c5dca2ef2c8
    Reviewed-on: https://gerrit.libreoffice.org/49384
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 2170acd08d1c..28713f47dbd7 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1354,7 +1354,7 @@ static void GetKern(TrueTypeFont *ttf)
     if( !table )
         goto badtable;
 
-    if (GetUInt16(table, 0) == 0) {                                /* Traditional Microsoft style table with sal_uInt16 version and nTables fields */
+    if (nTableSize >= 4 && GetUInt16(table, 0) == 0) { /* Traditional Microsoft style table with sal_uInt16 version and nTables fields */
         ttf->nkern = GetUInt16(table, 2);
         ttf->kerntype = KT_MICROSOFT;
         ptr = table + 4;
@@ -1386,7 +1386,7 @@ static void GetKern(TrueTypeFont *ttf)
         return;
     }
 
-    if (GetUInt32(table, 0) == 0x00010000) {                       /* MacOS style kern tables: fixed32 version and sal_uInt32 nTables fields */
+    if (nTableSize >= 8 && GetUInt32(table, 0) == 0x00010000) { /* MacOS style kern tables: fixed32 version and sal_uInt32 nTables fields */
         ttf->nkern = GetUInt32(table, 4);
         ttf->kerntype = KT_APPLE_NEW;
         ptr = table + 8;