vcl/source/fontsubset/sft.cxx | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
New commits: commit 987f34dd9a464cc6219b17f22c61c99956a2a9ed Author: Caolán McNamara <caol...@redhat.com> AuthorDate: Sun Feb 27 12:21:47 2022 +0000 Commit: Michael Stahl <michael.st...@allotropia.de> CommitDate: Tue Mar 1 18:02:00 2022 +0100 ofz#45082 Out-of-memory Change-Id: I274a6beeec0013f5b974017500fe31bcecabfa86 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130637 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.st...@allotropia.de> diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 4b54bda1767a..995c6b36373a 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -2099,10 +2099,15 @@ GlyphData *GetTTRawGlyphData(AbstractTrueTypeFont *ttf, sal_uInt32 glyphID) return nullptr; /* #127161# check the glyph offsets */ + sal_uInt32 nNextOffset = ttf->glyphOffset(glyphID + 1); + sal_uInt32 nOffset = ttf->glyphOffset(glyphID); + if (nNextOffset < nOffset) + return nullptr; + if (length < ttf->glyphOffset(glyphID + 1)) return nullptr; - length = ttf->glyphOffset(glyphID + 1) - ttf->glyphOffset(glyphID); + length = nNextOffset - nOffset; GlyphData* d = static_cast<GlyphData*>(malloc(sizeof(GlyphData))); assert(d != nullptr);