diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-02-15 09:06:43 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-02-15 14:06:25 +0100 |
| commit | a315bfee11b99b41ed6c2fc855e2ff9e10ce9a2b (patch) | |
| tree | 280b44cbf4208fa9c29d2d7b64edb09318167f95 | |
| parent | a12ad856148f2e2da55dcaa6e6c295bea6dc38c7 (diff) | |
ofz#6364 Integer-overflow
Change-Id: Ib7df07042bd78e7f3ca81818c97396a545566e3a
Reviewed-on: https://gerrit.libreoffice.org/49796
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | sw/source/filter/ww8/ww8scan.cxx | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index ef25e6353e46..b88e56badd9d 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -3899,7 +3899,12 @@ void WW8PLCFx_SubDoc::GetSprms(WW8PLCFxDesc* p) return; } - p->nEndPos = p->nStartPos + 1; + if (o3tl::checked_add<WW8_CP>(p->nStartPos, 1, p->nEndPos)) + { + SAL_WARN("sw.ww8", "broken offset, ignoring"); + p->nEndPos = p->nStartPos = WW8_CP_MAX; + return; + } if (!pText) return; |