diff --git a/gfx/thebes/src/gfxFontUtils.cpp b/gfx/thebes/src/gfxFontUtils.cpp index f5d71d0500f..ff421d93b3b 100644 --- a/gfx/thebes/src/gfxFontUtils.cpp +++ b/gfx/thebes/src/gfxFontUtils.cpp @@ -1824,22 +1824,22 @@ gfxFontUtils::MakeEOTHeader(const PRUint8 *aFontData, PRUint32 aFontDataLength, PRUint32 nameoff = names[i].offset; // offset from base of string storage // sanity check the name string location - if (PRUint64(nameOffset) + PRUint64(nameStringsBase) + PRUint64(nameoff) - + PRUint64(namelen) > dataLength) { + if (PRUint64(nameOffset) + PRUint64(nameStringsBase) + + PRUint64(nameoff) + PRUint64(namelen) > dataLength) { return NS_ERROR_FAILURE; } - - strOffset = nameOffset + nameStringsBase + nameoff + namelen; - // output 2-byte str size + strOffset = nameOffset + nameStringsBase + nameoff; + + // output 2-byte str size strLen = namelen & (~1); // UTF-16 string len must be even *((PRUint16*) eotEnd) = PRUint16(strLen); eotEnd += 2; - // length is number of UTF-16 chars, not bytes - CopySwapUTF16(reinterpret_cast(aFontData + strOffset), - reinterpret_cast(eotEnd), - (strLen >> 1)); + // length is number of UTF-16 chars, not bytes + CopySwapUTF16(reinterpret_cast(aFontData + strOffset), + reinterpret_cast(eotEnd), + (strLen >> 1)); eotEnd += strLen; // add 2-byte zero padding to the end of each string