diff --git a/Userland/Libraries/LibGfx/Font/WOFF/Font.cpp b/Userland/Libraries/LibGfx/Font/WOFF/Font.cpp index f4a0e5befd..bba95149c0 100644 --- a/Userland/Libraries/LibGfx/Font/WOFF/Font.cpp +++ b/Userland/Libraries/LibGfx/Font/WOFF/Font.cpp @@ -93,6 +93,8 @@ ErrorOr> Font::try_load_from_externally_owned_memory(Readonl if (header.length > buffer.size()) return Error::from_string_literal("Invalid WOFF length"); + if (header.num_tables > NumericLimits::max() / 16) + return Error::from_string_literal("Invalid WOFF numTables"); if (header.reserved != 0) return Error::from_string_literal("Invalid WOFF reserved field"); if (header.meta_length == 0 && header.meta_offset != 0)