diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-10-25 15:34:47 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-10-25 21:30:15 +0200 |
| commit | 71518d1898e574351dab4513a2d55bbed2b47fe3 (patch) | |
| tree | dd0c099ab293d99dd0c52fa7b15c9ec45cde0f2c | |
| parent | ad4ca547e57858d0051d89f1b4799ed8cbbe2ffa (diff) | |
ofz Integer overflow
Change-Id: I4ee001f2f587612f0a924e02f4f3fae4c7afbe75
Reviewed-on: https://gerrit.libreoffice.org/43844
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | sw/source/filter/ww8/ww8scan.cxx | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index 3a3030945306..3055feca08a5 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -3388,7 +3388,13 @@ void WW8PLCFx_Cp_FKP::GetSprms(WW8PLCFxDesc* p) continue; } } - nLimitFC = nFcStart + nCpLen; + + const bool bFail = o3tl::checked_add(nFcStart, nCpLen, nLimitFC); + if (bFail) + { + SAL_WARN("sw.ww8", "broken offset, ignoring"); + continue; + } //if it doesn't exist, skip it if (!SeekPos(nCpStart)) |