vcl/source/fontsubset/sft.cxx |   17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

New commits:
commit 9b5a94d2270ec8edff0b0a15fdf3cfe01b55ef24
Author:     Caolán McNamara <[email protected]>
AuthorDate: Mon Feb 28 20:49:20 2022 +0000
Commit:     Michael Stahl <[email protected]>
CommitDate: Tue Mar 1 18:35:13 2022 +0100

    ofz: verify table offsets
    
    Change-Id: I49fa886508b3bf553d4f638bfe53c37fa3e2f338
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130682
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 4d2eba36c7f3..bdc7e8208793 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1647,11 +1647,20 @@ SFErrCodes CreateTTFromTTGlyphs(AbstractTrueTypeFont  
*ttf,
 
     /**                       post                          **/
     if ((p = ttf->table(O_post, nTableSize)) != nullptr)
+    {
+        sal_Int32 nItalic = (POST_italicAngle_offset + 4 < nTableSize) ?
+            GetInt32(p, POST_italicAngle_offset) : 0;
+        sal_Int16 nPosition = (POST_underlinePosition_offset + 2 < nTableSize) 
?
+            GetInt16(p, POST_underlinePosition_offset) : 0;
+        sal_Int16 nThickness = (POST_underlineThickness_offset + 2 < 
nTableSize) ?
+            GetInt16(p, POST_underlineThickness_offset) : 0;
+        sal_uInt32 nFixedPitch = (POST_isFixedPitch_offset + 4 < nTableSize) ?
+            GetUInt32(p, POST_isFixedPitch_offset) : 0;
+
         post = TrueTypeTableNew_post(0x00030000,
-                                     GetInt32(p, POST_italicAngle_offset),
-                                     GetInt16(p, 
POST_underlinePosition_offset),
-                                     GetInt16(p, 
POST_underlineThickness_offset),
-                                     GetUInt32(p, POST_isFixedPitch_offset));
+                                     nItalic, nPosition,
+                                     nThickness, nFixedPitch);
+    }
     else
         post = TrueTypeTableNew_post(0x00030000, 0, 0, 0, 0);
 

Reply via email to