[Libreoffice-commits] core.git: Branch 'libreoffice-5-4' - vcl/source

[Caolán McNamara]

 vcl/source/fontsubset/sft.cxx |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

New commits:
commit e3308146244efb1985e1d84a5ddfb8ac1754d5c5
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 7 16:44:43 2018 +0000

    check O_hhea and O_vhea sizes
    
    Change-Id: I82e47732815f0112801c8c3a3e5b0b09ac25610a
    Reviewed-on: https://gerrit.libreoffice.org/49439
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Jenkins <ci at libreoffice.org>

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 97a16958f7b8..5b9dba4c29ec 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1452,8 +1452,10 @@ int OpenTTFontBuffer(const void* pBuffer, sal_uInt32 nLen, sal_uInt32 facenum, T
 
 static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
 {
-    if (t->fsize < 4)
+    if (t->fsize < 4) {
+        CloseTTFont(t);
         return SF_TTFORMAT;
+    }
     int i;
     sal_uInt32 length, tag;
     sal_uInt32 tdoffset = 0;        /* offset to TableDirectory in a TTC file. For TTF files is 0 */
@@ -1633,10 +1635,12 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
     }
 
     table = getTable(t, O_hhea);
-    t->numberOfHMetrics = (table != nullptr) ? GetUInt16(table, 34) : 0;
+    table_size = getTableSize(t, O_hhea);
+    t->numberOfHMetrics = (table && table_size >= 36) ? GetUInt16(table, 34) : 0;
 
     table = getTable(t, O_vhea);
-    t->numOfLongVerMetrics = (table != nullptr) ? GetUInt16(table, 34) : 0;
+    table_size = getTableSize(t, O_vhea);
+    t->numOfLongVerMetrics = (table && table_size >= 36) ? GetUInt16(table, 34) : 0;
 
     GetNames(t);
     FindCmap(t);