From 4ab4943a9213b33a5e375c590b577cbc51b7bb97 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Sat, 4 Jul 2026 15:34:05 +0100
Subject: [PATCH] [PATCH] ofz: wmf, check record against max allowed size
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I3c0a155bdf0922771694fc500a24eb09ec8abc27
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6116
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 9b412f7cda30a4e1b820e51249fa7b3c36a812d3)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207658
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit 1db305f340787ab7e59d089e51ac9d6fc07c2715)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207675
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207726
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>

Gbp-Pq: Name CVE-2026-63275.diff
---
 vcl/source/fontsubset/cff.cxx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/vcl/source/fontsubset/cff.cxx b/vcl/source/fontsubset/cff.cxx
index 595bca4d4f5..44c8faa9888 100644
--- a/vcl/source/fontsubset/cff.cxx
+++ b/vcl/source/fontsubset/cff.cxx
@@ -870,7 +870,8 @@ void CffSubsetterContext::addHints( bool bVerticalHints)
     if( mnStackIdx & 1) --mnStackIdx;//#######
     // TODO: if( !bSubr) assert( mnStackIdx >= 2);
 
-    assert( (mnHintSize + mnStackIdx) <= 2*NMAXHINTS);
+    if (o3tl::make_unsigned(mnHintSize + mnStackIdx) > std::size(mnHintStack))
+        return;
 
     ValType nHintOfs = 0;
     for( int i = 0; i < mnStackIdx; ++i) {
-- 
2.39.5