summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2022-01-09 16:16:39 +0000
committerXisco Fauli <xiscofauli@libreoffice.org>2022-01-11 10:07:05 +0100
commit1f7ae933a62742d7626859a00750f795551843f3 (patch)
treeb1736a64f4e67d2abc298db58800df34b406d162
parentebc5d02a0d4a716fb4efb4ce17a622eb21cf7c9c (diff)
ofz#43458 avoid OOM
Change-Id: Id0e1e985c446c147a219ba2f5157a41deae656a4 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128193 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit e28f4b6bccafb2b9f3c44dfabf36d1b822d85f84) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128235 Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
-rw-r--r--lotuswordpro/source/filter/lwpdrawobj.cxx2
1 files changed, 2 insertions, 0 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx
index 5245bfd93ddc..d6255b2e63d7 100644
--- a/lotuswordpro/source/filter/lwpdrawobj.cxx
+++ b/lotuswordpro/source/filter/lwpdrawobj.cxx
@@ -1047,6 +1047,8 @@ void LwpDrawTextBox::Read()
// the 71 is the fixed length before text content in textbox record
sal_Int16 TextLength = m_aObjHeader.nRecLen - 71;
+ if (TextLength < 0)
+ throw BadRead();
m_aTextRec.pTextString = new sal_uInt8 [TextLength];
m_pStream->ReadBytes(m_aTextRec.pTextString, TextLength);