diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2022-01-13 16:57:48 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2022-01-13 20:25:11 +0100 |
| commit | 444477a07bcaf59181dbbc719b913566091deadc (patch) | |
| tree | fef9b0f5f0d4827478b9b4d27962b6f81b4a42c9 /lotuswordpro | |
| parent | b589fc5a8d1124b81ac75dfac972c1036ae55477 (diff) | |
ofz#43577 valid reclen must be >= 20
Change-Id: I454bff4acfcd85701a7f094a8bd76898825e9ce2
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128388
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'lotuswordpro')
| -rw-r--r-- | lotuswordpro/source/filter/lwpdrawobj.cxx | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index 55d23be1ef7b..0e78359fa0c6 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -1362,6 +1362,9 @@ void LwpDrawBitmap::Read() m_pStream->ReadUInt16( m_aBmpRec.nTranslation ); m_pStream->ReadUInt16( m_aBmpRec.nRotation ); + if (m_aObjHeader.nRecLen < 20) + throw BadRead(); + // 20 == length of draw-specific fields. // 14 == length of bmp file header. m_aBmpRec.nFileSize = m_aObjHeader.nRecLen - 20 + 14; |