[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/font/fontcharmap.cxx |    5 +++++
 1 file changed, 5 insertions(+)

New commits:
commit 52b92a591943c1988fd3d660bd6fc5ac53ce0f33
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Jul 24 12:18:10 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Wed Jul 24 21:28:26 2019 +0200

    cid#1209863 Untrusted loop bound
    
    Change-Id: Ic8d20e92b4021dfebe01e1265c3afb2bcd509827
    Reviewed-on: https://gerrit.libreoffice.org/76259
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/source/font/fontcharmap.cxx b/vcl/source/font/fontcharmap.cxx
index b057a2056645..8d8dd5815dc1 100644
--- a/vcl/source/font/fontcharmap.cxx
+++ b/vcl/source/font/fontcharmap.cxx
@@ -232,6 +232,11 @@ bool ParseCMAP( const unsigned char* pCmap, int nLength, CmapResult& rResult )
     else if( (nFormat == 12) && ((nOffset+16) < nLength) )
     {
         nRangeCount = GetUInt( pCmap + nOffset + 12 );
+        if (nRangeCount < 0)
+        {
+            SAL_WARN("vcl.gdi", "negative RangeCount");
+            nRangeCount = 0;
+        }
 
         const int nGroupOffset = nOffset + 16;
         const int nRemainingLen = nLength - nGroupOffset;