Index: src/hdmx.cc |
diff --git a/src/hdmx.cc b/src/hdmx.cc |
index c30ac4893fb6b3c9ebf9a526d61e247121138310..570fab1682b2d38cb8623240f3b4beeee273bd5d 100644 |
--- a/src/hdmx.cc |
+++ b/src/hdmx.cc |
@@ -105,13 +105,16 @@ bool ots_hdmx_should_serialise(OpenTypeFile *file) { |
bool ots_hdmx_serialise(OTSStream *out, OpenTypeFile *file) { |
OpenTypeHDMX * const hdmx = file->hdmx; |
- if (!out->WriteU16(hdmx->version) || |
- !out->WriteS16(hdmx->records.size()) || |
+ const int16_t num_recs = static_cast<int16_t>(hdmx->records.size()); |
+ if (hdmx->records.size() > |
+ static_cast<size_t>(std::numeric_limits<int16_t>::max()) || |
+ !out->WriteU16(hdmx->version) || |
+ !out->WriteS16(num_recs) || |
!out->WriteS32(hdmx->size_device_record)) { |
return OTS_FAILURE(); |
} |
- for (unsigned i = 0; i < hdmx->records.size(); ++i) { |
+ for (int16_t i = 0; i < num_recs; ++i) { |
const OpenTypeHDMXDeviceRecord& rec = hdmx->records[i]; |
if (!out->Write(&rec.pixel_size, 1) || |
!out->Write(&rec.max_width, 1) || |