diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-10-25 15:39:57 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-10-25 21:32:57 +0200 |
| commit | 933b66c1227bb9c0e6b80a16e45d9153cea9e8a8 (patch) | |
| tree | 6cabb3b58a465c7d9e353bf8fc7acb69f19da029 | |
| parent | 438e8b846f0f1d6fd2007c0871d26c005f254902 (diff) | |
ofz Integer-overflow
Change-Id: I12d0d5d33be273d85822883598c20c793bceb706
Reviewed-on: https://gerrit.libreoffice.org/43845
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | sw/source/filter/ww8/ww8scan.cxx | 19 |
1 files changed, 16 insertions, 3 deletions
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index 3055feca08a5..c3adbf485d8f 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -1509,17 +1509,30 @@ WW8_FC WW8ScannerBase::WW8Cp2Fc(WW8_CP nCpPos, bool* pIsUnicode, else *pIsUnicode = m_pWw8Fib->m_fExtChar; - WW8_CP nCpLen = nCpPos - nCpStart; + WW8_CP nCpLen; + bool bFail = o3tl::checked_sub(nCpPos, nCpStart, nCpLen); + if (bFail) + { + SAL_WARN("sw.ww8", "broken offset, ignoring"); + return WW8_CP_MAX; + } + if (*pIsUnicode) { - const bool bFail = o3tl::checked_multiply<WW8_CP>(nCpLen, 2, nCpLen); + bFail = o3tl::checked_multiply<WW8_CP>(nCpLen, 2, nCpLen); if (bFail) { SAL_WARN("sw.ww8", "broken offset, ignoring"); return WW8_CP_MAX; } } - nRet += nCpLen; + + bFail = o3tl::checked_add(nRet, nCpLen, nRet); + if (bFail) + { + SAL_WARN("sw.ww8", "broken offset, ignoring"); + return WW8_CP_MAX; + } return nRet; } |