vcl/source/filter/svm/SvmConverter.cxx | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
New commits:
commit 07768f467736f6ab558c5c6975a9baab09dc92ec
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sat Jul 16 11:37:22 2022 +0100
Commit: Michael Stahl <michael.st...@allotropia.de>
CommitDate: Mon Jul 18 11:00:51 2022 +0200
ofz#49157 Object-size
Change-Id: I3a17d7967512a282b13894ba479aa3507f1be38f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/137069
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
diff --git a/vcl/source/filter/svm/SvmConverter.cxx
b/vcl/source/filter/svm/SvmConverter.cxx
index ac1592efb498..abe2193ae118 100644
--- a/vcl/source/filter/svm/SvmConverter.cxx
+++ b/vcl/source/filter/svm/SvmConverter.cxx
@@ -781,17 +781,22 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm,
GDIMetaFile& rMtf )
aFontVDev->GetTextArray( aStr, &aTmpAry,
nIndex, nLen );
- // now, the difference between the
- // last and the second last DX array
- // is the advancement for the last
- // glyph. Thus, to complete our meta
- // action's DX array, just add that
- // difference to last elem and store
- // in very last.
- if( nStrLen > 1 )
- aDXAry[ nStrLen-1 ] = aDXAry[
nStrLen-2 ] + aTmpAry[ nStrLen-1 ] - aTmpAry[ nStrLen-2 ];
+ if (aTmpAry.size() <
o3tl::make_unsigned(nStrLen))
+ SAL_WARN("vcl.gdi", "TextArray too
short to recover missing element");
else
- aDXAry[ nStrLen-1 ] = aTmpAry[
nStrLen-1 ]; // len=1: 0th position taken to be 0
+ {
+ // now, the difference between the
+ // last and the second last DX array
+ // is the advancement for the last
+ // glyph. Thus, to complete our meta
+ // action's DX array, just add that
+ // difference to last elem and store
+ // in very last.
+ if( nStrLen > 1 )
+ aDXAry[ nStrLen-1 ] = aDXAry[
nStrLen-2 ] + aTmpAry[ nStrLen-1 ] - aTmpAry[ nStrLen-2 ];
+ else
+ aDXAry[ nStrLen-1 ] = aTmpAry[
nStrLen-1 ]; // len=1: 0th position taken to be 0
+ }
}
#ifdef DBG_UTIL
else
