diff options
| author | Lei Zhang <leizleiz@users.noreply.github.com> | 2016-10-19 14:52:17 -0700 |
|---|---|---|
| committer | Lei Zhang <leizleiz@users.noreply.github.com> | 2016-10-19 14:52:17 -0700 |
| commit | d651349cc7d61e667eadc186d5081a31a4339ee3 (patch) | |
| tree | d99212600890b35054c822b30773095d275f69e9 /cpp | |
| parent | 8475d2fd5f1ee4c734ea900c88283365a2f0dc87 (diff) | |
| download | sfntly-d651349cc7d61e667eadc186d5081a31a4339ee3.tar.gz | |
Check for negative size in NameTable::NameAsBytes.
Fixes https://crbug.com/654663
Diffstat (limited to 'cpp')
| -rw-r--r-- | cpp/src/sfntly/table/core/name_table.cc | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/cpp/src/sfntly/table/core/name_table.cc b/cpp/src/sfntly/table/core/name_table.cc index 8d2f64f..c9fe468 100644 --- a/cpp/src/sfntly/table/core/name_table.cc +++ b/cpp/src/sfntly/table/core/name_table.cc @@ -469,12 +469,14 @@ int32_t NameTable::NameId(int32_t index) { void NameTable::NameAsBytes(int32_t index, ByteVector* b) { assert(b); - int32_t length = NameLength(index); b->clear(); + + int32_t length = NameLength(index); + if (length <= 0) + return; + b->resize(length); - if (length > 0) { - data_->ReadBytes(NameOffset(index), &((*b)[0]), 0, length); - } + data_->ReadBytes(NameOffset(index), &((*b)[0]), 0, length); } void NameTable::NameAsBytes(int32_t platform_id, |