diff options
author | Colin Cross <ccross@android.com> | 2017-06-06 02:51:35 +0000 |
---|---|---|
committer | android-build-merger <android-build-merger@google.com> | 2017-06-06 02:51:35 +0000 |
commit | 3d3aab44bf4341afecf35b10c40b20e85906a1ef (patch) | |
tree | a77368b5efd882b6d7c224d8fd9f5b6948d48071 /cpp/src/sfntly/data/writable_font_data.cc | |
parent | 90e121df2741a3e4eb6a78da1d39c299c5a2eca9 (diff) | |
parent | fd76129cde3ff870adaf9bd8649ad1dad90bb9e7 (diff) | |
download | sfntly-3d3aab44bf4341afecf35b10c40b20e85906a1ef.tar.gz |
Merge remote-tracking branch 'aosp/upstream-master' into master am: d7c3ad1d95
am: fd76129cde
Change-Id: Ibe3ac0fb59f7497c51a4d41bf24c5d9290c46f9e
Diffstat (limited to 'cpp/src/sfntly/data/writable_font_data.cc')
-rw-r--r-- | cpp/src/sfntly/data/writable_font_data.cc | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/cpp/src/sfntly/data/writable_font_data.cc b/cpp/src/sfntly/data/writable_font_data.cc index 7f6f72f..073e9df 100644 --- a/cpp/src/sfntly/data/writable_font_data.cc +++ b/cpp/src/sfntly/data/writable_font_data.cc @@ -16,6 +16,9 @@ #include "sfntly/data/writable_font_data.h" +#include <algorithm> +#include <limits> + #include "sfntly/data/memory_byte_array.h" #include "sfntly/data/growable_memory_byte_array.h" @@ -165,7 +168,9 @@ void WritableFontData::CopyFrom(InputStream* is) { CALLER_ATTACH FontData* WritableFontData::Slice(int32_t offset, int32_t length) { - if (offset < 0 || offset + length > Size()) { + if (offset < 0 || length < 0 || + offset > std::numeric_limits<int32_t>::max() - length || + offset + length > Size()) { #if !defined (SFNTLY_NO_EXCEPTION) throw IndexOutOfBoundsException( "Attempt to bind data outside of its limits"); @@ -177,7 +182,7 @@ CALLER_ATTACH FontData* WritableFontData::Slice(int32_t offset, } CALLER_ATTACH FontData* WritableFontData::Slice(int32_t offset) { - if (offset > Size()) { + if (offset < 0 || offset > Size()) { #if !defined (SFNTLY_NO_EXCEPTION) throw IndexOutOfBoundsException( "Attempt to bind data outside of its limits"); |