diff --git a/src/sfnt/ttcolr.c b/src/sfnt/ttcolr.c index 7929b7aaf..0307aae7e 100644 --- a/src/sfnt/ttcolr.c +++ b/src/sfnt/ttcolr.c @@ -236,8 +236,10 @@ p1 = (FT_Byte*)( table + base_glyphs_offset_v1 ); num_base_glyphs_v1 = FT_PEEK_ULONG( p1 ); - if ( ( table_size - base_glyphs_offset_v1 ) / BASE_GLYPH_PAINT_RECORD_SIZE - < num_base_glyphs_v1 ) + /* Account for 4 byte numBaseGlyphPaintRecords at the beginning of */ + /* the BaseGlyphPaintRecord array. */ + if ( ( table_size - base_glyphs_offset_v1 - 4 ) / + BASE_GLYPH_PAINT_RECORD_SIZE < num_base_glyphs_v1 ) goto InvalidTable; colr->num_base_glyphs_v1 = num_base_glyphs_v1;