[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/fontsubset/sft.cxx |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

New commits:
commit d25142d2c33dea9fa9332a0cbc07694129ce48ed
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Feb 27 12:21:47 2022 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Sun Feb 27 15:55:27 2022 +0100

    ofz#45082 Out-of-memory
    
    Change-Id: I274a6beeec0013f5b974017500fe31bcecabfa86
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130623
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 91efdfb63480..effe83ff55ce 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -2104,10 +2104,15 @@ GlyphData *GetTTRawGlyphData(AbstractTrueTypeFont *ttf, 
sal_uInt32 glyphID)
         return nullptr;
 
     /* #127161# check the glyph offsets */
+    sal_uInt32 nNextOffset = ttf->glyphOffset(glyphID + 1);
+    sal_uInt32 nOffset = ttf->glyphOffset(glyphID);
+    if (nNextOffset < nOffset)
+        return nullptr;
+
     if (length < ttf->glyphOffset(glyphID + 1))
         return nullptr;
 
-    length = ttf->glyphOffset(glyphID + 1) - ttf->glyphOffset(glyphID);
+    length = nNextOffset - nOffset;
 
     GlyphData* d = static_cast<GlyphData*>(malloc(sizeof(GlyphData))); 
assert(d != nullptr);