ttf: When doing bounds checking for cmap4 size, account for table offset.

diff --git a/source/fitz/subset-ttf.c b/source/fitz/subset-ttf.c
index b9c461b4949f68ed259ba72c13b351dbd6a1b4ae..1d4d64791b20c6f74305d4721ef4f76d02bb74e0 100644 (file)
--- a/source/fitz/subset-ttf.c
+++ b/source/fitz/subset-ttf.c
@@ -574,7 +574,7 @@ load_enc_tab4(fz_context *ctx, uint8_t *d, size_t data_size, uint32_t offset)
        uint16_t seg_count;
        uint32_t i;
 
-       if (data_size < 26)
+       if (data_size < offset + 26)
                fz_throw(ctx, FZ_ERROR_FORMAT, "cmap4 too small");
 
        seg_count = get16(d+offset+6); /* 2 * seg_count */