[Libreoffice-commits] core.git: Branch 'libreoffice-7-0' - vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/font/fontcharmap.cxx |    6 ++++++
 1 file changed, 6 insertions(+)

New commits:
commit 62680e9bec0a9a32659e9146e12e13d5fcafc0b4
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Sep 16 10:16:49 2020 +0100
Commit:     Xisco Fauli <xiscofauli at libreoffice.org>
CommitDate: Wed Sep 16 14:02:02 2020 +0200

    ofz#25696 OOM
    
    Change-Id: Ia69e9ce1ca0156e960dddb7e0bf98dfd2be2d7cc
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/102759
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofauli at libreoffice.org>

diff --git a/vcl/source/font/fontcharmap.cxx b/vcl/source/font/fontcharmap.cxx
index f8c95e796b20..7225f385ad56 100644
--- a/vcl/source/font/fontcharmap.cxx
+++ b/vcl/source/font/fontcharmap.cxx
@@ -179,6 +179,12 @@ bool ParseCMAP( const unsigned char* pCmap, int nLength, CmapResult& rResult )
     {
         int nSegCountX2 = GetUShort( pCmap + nOffset + 6 );
         nRangeCount = nSegCountX2/2 - 1;
+        if (nRangeCount < 0)
+        {
+            SAL_WARN("vcl.gdi", "negative RangeCount");
+            nRangeCount = 0;
+        }
+
         pCodePairs = new sal_UCS4[ nRangeCount * 2 ];
         pStartGlyphs = new int[ nRangeCount ];
         const unsigned char* pLimitBase = pCmap + nOffset + 14;