[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara]

 vcl/source/fontsubset/sft.cxx |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

New commits:
commit 3c94e8c3e6b1b0bce03a4cfc63df62f5ed176666
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 7 16:44:43 2018 +0000

    check O_hhea and O_vhea sizes
    
    Change-Id: I82e47732815f0112801c8c3a3e5b0b09ac25610a
    Reviewed-on: https://gerrit.libreoffice.org/49377
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 1e2215a1ae6f..cfad36e35f64 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1521,8 +1521,10 @@ int OpenTTFontBuffer(const void* pBuffer, sal_uInt32 nLen, sal_uInt32 facenum, T
 
 static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
 {
-    if (t->fsize < 4)
+    if (t->fsize < 4) {
+        CloseTTFont(t);
         return SF_TTFORMAT;
+    }
     int i;
     sal_uInt32 length, tag;
     sal_uInt32 tdoffset = 0;        /* offset to TableDirectory in a TTC file. For TTF files is 0 */
@@ -1699,10 +1701,12 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
     }
 
     table = getTable(t, O_hhea);
-    t->numberOfHMetrics = (table != nullptr) ? GetUInt16(table, 34) : 0;
+    table_size = getTableSize(t, O_hhea);
+    t->numberOfHMetrics = (table && table_size >= 36) ? GetUInt16(table, 34) : 0;
 
     table = getTable(t, O_vhea);
-    t->numOfLongVerMetrics = (table != nullptr) ? GetUInt16(table, 34) : 0;
+    table_size = getTableSize(t, O_vhea);
+    t->numOfLongVerMetrics = (table && table_size >= 36) ? GetUInt16(table, 34) : 0;
 
     GetNames(t);
     FindCmap(t);