[PATCH] ofz: wmf, check record against max allowed size

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I3c0a155bdf0922771694fc500a24eb09ec8abc27
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6116
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 9b412f7cda30a4e1b820e51249fa7b3c36a812d3)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207658
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit 1db305f340787ab7e59d089e51ac9d6fc07c2715)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207675
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207726
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Gbp-Pq: Name CVE-2026-63275.diff

diff --git a/vcl/source/fontsubset/cff.cxx b/vcl/source/fontsubset/cff.cxx
index 595bca4d4f5dfbf6e3ae97b41775441f0bfef148..44c8faa9888077bbaa93ce7d760f56e341d0b62f 100644 (file)
--- a/vcl/source/fontsubset/cff.cxx
+++ b/vcl/source/fontsubset/cff.cxx
@@ -870,7 +870,8 @@ void CffSubsetterContext::addHints( bool bVerticalHints)
     if( mnStackIdx & 1) --mnStackIdx;//#######
     // TODO: if( !bSubr) assert( mnStackIdx >= 2);
 
-    assert( (mnHintSize + mnStackIdx) <= 2*NMAXHINTS);
+    if (o3tl::make_unsigned(mnHintSize + mnStackIdx) > std::size(mnHintStack))
+        return;
 
     ValType nHintOfs = 0;
     for( int i = 0; i < mnStackIdx; ++i) {