diff options
author | Stephan Bergmann <sbergman@redhat.com> | 2019-02-22 11:56:51 +0100 |
---|---|---|
committer | Stephan Bergmann <sbergman@redhat.com> | 2019-02-22 15:01:34 +0100 |
commit | 18b5a001cc5b306e1548fb70e610bdc1164cf4ca (patch) | |
tree | 9dbe48650483e4e216c83255401b53e89d10109d /idl | |
parent | 70c3d1a25a0ace873ce7fa4b49af416f8fa6f1ff (diff) |
Avoid uncontrolled overflow in SwTable::GetBoxNum
...where bad input like "WRONG CELL NAME" (in PythonTest_sw_python's
sw/qa/python/check_xtexttable.py) could wrap around to a valid but wrong nRet.
Instead, return SAL_MAX_UINT16 upon overflow. At least the call to GetBoxNum in
SwTable::GetTableBox (sw/source/core/table/swtable.cxx) with bFirstPart
potentially true, assigning to nBox, then later checks
if( nBox >= pBoxes->size() )
return nullptr;
so returning SAL_MAX_UINT16 upon overflow appears to be the best choice.
(Found with Clang's -fsanitize=implicit-signed-integer-truncation.)
Change-Id: I12822a6bd4f0269adb14c04eefbd1cde4d288728
Reviewed-on: https://gerrit.libreoffice.org/68203
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
Diffstat (limited to 'idl')
0 files changed, 0 insertions, 0 deletions