[Libreoffice-commits] core.git: Branch 'libreoffice-7-0' - vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/font/fontcharmap.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit ebafb8740b999dc3f508a93526d4f6ef5c3d3446
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Sep 29 20:59:40 2020 +0100
Commit:     Xisco Fauli <xiscofauli at libreoffice.org>
CommitDate: Thu Oct 1 10:33:26 2020 +0200

    ofz#25989 cmap parsing
    
    Change-Id: I048e5d88d5926a4afa75afab18db5ca6354e2454
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103656
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofauli at libreoffice.org>

diff --git a/vcl/source/font/fontcharmap.cxx b/vcl/source/font/fontcharmap.cxx
index 229f4f36789f..c29fd3cdbd22 100644
--- a/vcl/source/font/fontcharmap.cxx
+++ b/vcl/source/font/fontcharmap.cxx
@@ -228,7 +228,7 @@ bool ParseCMAP( const unsigned char* pCmap, int nLength, CmapResult& rResult )
                 // update the glyphid-array with the glyphs in this range
                 pStartGlyphs[i] = -static_cast<int>(aGlyphIdArray.size());
                 const unsigned char* pGlyphIdPtr = pOffsetBase + 2*i + nRangeOffset;
-                const size_t nRemainingSize = pEndValidArea - pGlyphIdPtr;
+                const size_t nRemainingSize = pEndValidArea >= pGlyphIdPtr ? pEndValidArea - pGlyphIdPtr : 0;
                 const size_t nMaxPossibleRecords = nRemainingSize/2;
                 if (nMaxPossibleRecords == 0) {  // no sane font should trigger this
                     SAL_WARN("vcl.gdi", "More indexes claimed that space available in font!");