More cmap4 bounds checks

silnrsi · c36204c44d0c73d8afeff3fe3a1bdf3f5fd7d8bd · mhosken committed Mar 9, 2016 · Mar 9, 2016 · c36204c
1 parent 65daac7
commit c36204c44d0c73d8afeff3fe3a1bdf3f5fd7d8bd
Unified Split

Showing with 1 addition and 1 deletion.

+1 −1 src/TtfUtil.cpp
diff --git a/src/TtfUtil.cpp b/src/TtfUtil.cpp
@@ -906,7 +906,7 @@ bool CheckCmapSubtable4(const void * pCmapSubtable4, const void * pCmapEnd /*, u
     if (length < sizeof(Sfnt::CmapSubTableFormat4))
         return false;
     uint16 nRanges = be::swap(pTable4->seg_count_x2) >> 1;
-    if (length < sizeof(Sfnt::CmapSubTableFormat4) + 4 * nRanges * sizeof(uint16))
+    if (!nRanges || length < sizeof(Sfnt::CmapSubTableFormat4) + 4 * nRanges * sizeof(uint16))
         return false;
     // check last range is properly terminated
     uint16 chEnd = be::peek<uint16>(pTable4->end_code + nRanges - 1);