Skip to content

C
core
Kaydet (Commit) bb32616b authored tarafından Caolán McNamara's avatar Caolán McNamara
Dosyalara gözat
Seçenekler

bounds check 

Change-Id: I6d32a6b6f1dd91db42a3f154700ea55603f0e4dd
üst c7b0117f
Hide whitespace changes
Inline Side-by-side
Showing with 1 addition and 1 deletion
vcl/source/fontsubset/sft.cxx
Dosyayı görüntüle @ bb32616b
...@@ -1502,7 +1502,7 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) ...@@ -1502,7 +1502,7 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
if (Version != 0x00010000 && Version != 0x00020000) { if (Version != 0x00010000 && Version != 0x00020000) {
return SF_TTFORMAT; return SF_TTFORMAT;
} }
if (facenum >= GetUInt32(t->ptr, 8)) { if (!withinBounds(8, 0, sizeof(sal_uInt32), t->fsize) || facenum >= GetUInt32(t->ptr, 8)) {
return SF_FONTNO; return SF_FONTNO;
} }
if (withinBounds(12, 4 * facenum, sizeof(sal_uInt32), t->fsize)) { if (withinBounds(12, 4 * facenum, sizeof(sal_uInt32), t->fsize)) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment