[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/font/fontcharmap.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 9a1202edab0cfe95572f12a8c49ef756ead49bf2
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Sep 29 20:59:40 2020 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Wed Sep 30 12:51:25 2020 +0200

    ofz#25989 cmap parsing
    
    Change-Id: I048e5d88d5926a4afa75afab18db5ca6354e2454
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103641
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/source/font/fontcharmap.cxx b/vcl/source/font/fontcharmap.cxx
index 5b6b829d206a..92ad9b256f0b 100644
--- a/vcl/source/font/fontcharmap.cxx
+++ b/vcl/source/font/fontcharmap.cxx
@@ -230,7 +230,7 @@ bool ParseCMAP( const unsigned char* pCmap, int nLength, CmapResult& rResult )
                 // update the glyphid-array with the glyphs in this range
                 pStartGlyphs[i] = -static_cast<int>(aGlyphIdArray.size());
                 const unsigned char* pGlyphIdPtr = pOffsetBase + 2*i + nRangeOffset;
-                const size_t nRemainingSize = pEndValidArea - pGlyphIdPtr;
+                const size_t nRemainingSize = pEndValidArea >= pGlyphIdPtr ? pEndValidArea - pGlyphIdPtr : 0;
                 const size_t nMaxPossibleRecords = nRemainingSize/2;
                 if (nMaxPossibleRecords == 0) {  // no sane font should trigger this
                     SAL_WARN("vcl.gdi", "More indexes claimed that space available in font!");