diff options
| author | Chris Liddell <chris.liddell@artifex.com> | 2017-06-29 11:00:38 +0100 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2017-06-30 14:08:55 +0100 |
| commit | d592ee18a9168b1190bc7f7a1426b41fa6d508af (patch) | |
| tree | 72bec897ca6cbe7c0d5811f659858752ffd62a99 /xps | |
| parent | 0c39ac5a0b8ca650101ac6322be34bd7504e7f63 (diff) | |
| download | ghostpdl-d592ee18a9168b1190bc7f7a1426b41fa6d508af.tar.gz | |
Bug 698151: XPS: bounds check selecting cmap table.
Diffstat (limited to 'xps')
| -rw-r--r-- | xps/xpsfont.c | 20 |
1 files changed, 11 insertions, 9 deletions
diff --git a/xps/xpsfont.c b/xps/xpsfont.c index f65780b99..ddd3950fd 100644 --- a/xps/xpsfont.c +++ b/xps/xpsfont.c @@ -293,17 +293,19 @@ xps_load_sfnt_cmap(xps_font_t *font) } cmapdata = font->data + offset; - - nsubtables = u16(cmapdata + 2); - if (nsubtables < 0 || length < 4 + nsubtables * 8) + if (cmapdata + 4 < font->data + font->length) { - gs_warn("cannot find cmap sub-tables"); - return; - } + nsubtables = u16(cmapdata + 2); + if (nsubtables < 0 || length < 4 + nsubtables * 8) + { + gs_warn("cannot find cmap sub-tables"); + return; + } - font->cmaptable = offset; - font->cmapsubcount = nsubtables; - font->cmapsubtable = 0; + font->cmaptable = offset; + font->cmapsubcount = nsubtables; + font->cmapsubtable = 0; + } } /* |