[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/font/fontcharmap.cxx |    6 ++++++
 1 file changed, 6 insertions(+)

New commits:
commit d57b14e3394b081adf0888ed8dcb7b86d66c246c
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Sep 16 10:16:49 2020 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Wed Sep 16 12:20:17 2020 +0200

    ofz#25696 OOM
    
    Change-Id: Ia69e9ce1ca0156e960dddb7e0bf98dfd2be2d7cc
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/102846
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/source/font/fontcharmap.cxx b/vcl/source/font/fontcharmap.cxx
index a8a217ac9a5f..2a4ca017e3e2 100644
--- a/vcl/source/font/fontcharmap.cxx
+++ b/vcl/source/font/fontcharmap.cxx
@@ -184,6 +184,12 @@ bool ParseCMAP( const unsigned char* pCmap, int nLength, CmapResult& rResult )
     {
         int nSegCountX2 = GetUShort( pCmap + nOffset + 6 );
         nRangeCount = nSegCountX2/2 - 1;
+        if (nRangeCount < 0)
+        {
+            SAL_WARN("vcl.gdi", "negative RangeCount");
+            nRangeCount = 0;
+        }
+
         pCodePairs = new sal_UCS4[ nRangeCount * 2 ];
         pStartGlyphs = new int[ nRangeCount ];
         const unsigned char* pLimitBase = pCmap + nOffset + 14;