[Libreoffice-commits] core.git: Branch 'libreoffice-6-0' - vcl/source

[Caolán McNamara]

 vcl/source/fontsubset/sft.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit ac09d2fe176fe936d3056b94c07869cfd45e698f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 7 15:33:36 2018 +0000

    check table size before reading nglyphs
    
    Change-Id: Ib511fdf16006877ca76085137eb9200601b2f8f7
    Reviewed-on: https://gerrit.libreoffice.org/49363
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 08dd51bfcaa6b493e134bcc7787cc18c36ad5db1)
    Reviewed-on: https://gerrit.libreoffice.org/49435
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 1bf9b9003de5..74bf0ff307f1 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1586,7 +1586,8 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
     }
 
     const sal_uInt8* table = getTable(t, O_maxp);
-    t->nglyphs = GetUInt16(table, 4);
+    sal_uInt32 table_size = getTableSize(t, O_maxp);
+    t->nglyphs = table_size >= 6 ? GetUInt16(table, 4) : 0;
 
     table = getTable(t, O_head);
     t->unitsPerEm = GetUInt16(table, 18);