check table size before reading nglyphs

Change-Id: Ib511fdf16006877ca76085137eb9200601b2f8f7
Reviewed-on: https://gerrit.libreoffice.org/49363Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 08dd51bf)
Reviewed-on: https://gerrit.libreoffice.org/49436Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit 419361ac)

vcl/source/fontsubset/sft.cxx

@@ -1680,7 +1680,8 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
     }
 
     const sal_uInt8* table = getTable(t, O_maxp);
-    t->nglyphs = GetUInt16(table, 4);
+    sal_uInt32 table_size = getTableSize(t, O_maxp);
+    t->nglyphs = table_size >= 6 ? GetUInt16(table, 4) : 0;
 
     table = getTable(t, O_head);
     t->unitsPerEm = GetUInt16(table, 18);