diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2021-09-08 14:40:05 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2021-09-08 17:09:30 +0200 |
| commit | 637068510682ec0cf63227d2f81bdcfc6598c7e6 (patch) | |
| tree | 62d56cc0287f9b338de52ff8dd0ccb318d91a9ca /lotuswordpro | |
| parent | 7b3a681a867eeb2d68abd4ce33b07cabfff224ef (diff) | |
ofz#27296 limit row span when fuzzing
Change-Id: I3069875f64acaf394cfef7f6478abc974022d536
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/121819
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'lotuswordpro')
| -rw-r--r-- | lotuswordpro/Library_lwpft.mk | 1 | ||||
| -rw-r--r-- | lotuswordpro/source/filter/lwpcelllayout.cxx | 6 |
2 files changed, 5 insertions, 2 deletions
diff --git a/lotuswordpro/Library_lwpft.mk b/lotuswordpro/Library_lwpft.mk index 5965b385e1bc..af0f940cc666 100644 --- a/lotuswordpro/Library_lwpft.mk +++ b/lotuswordpro/Library_lwpft.mk @@ -32,6 +32,7 @@ $(eval $(call gb_Library_use_libraries,lwpft,\ svxcore \ tl \ ucbhelper \ + utl \ vcl \ xo \ )) diff --git a/lotuswordpro/source/filter/lwpcelllayout.cxx b/lotuswordpro/source/filter/lwpcelllayout.cxx index 71d0bce8a943..ef39c4ae1009 100644 --- a/lotuswordpro/source/filter/lwpcelllayout.cxx +++ b/lotuswordpro/source/filter/lwpcelllayout.cxx @@ -67,6 +67,7 @@ #include <lwpglobalmgr.hxx> #include <sal/log.hxx> +#include <unotools/configmgr.hxx> #include <xfilter/xfstylemanager.hxx> #include <xfilter/xfcell.hxx> @@ -813,13 +814,14 @@ LwpCellBorderType LwpConnectedCellLayout::GetCellBorderType(sal_uInt16 nRow, sal void LwpConnectedCellLayout::Read() { LwpCellLayout::Read(); - sal_uInt16 numcols; cnumrows = m_pObjStrm->QuickReaduInt16(); - numcols = m_pObjStrm->QuickReaduInt16(); // written as a lushort + sal_uInt16 numcols = m_pObjStrm->QuickReaduInt16(); // written as a lushort cnumcols = static_cast<sal_uInt8>(numcols); m_nRealrowspan = cnumrows; + if (utl::ConfigManager::IsFuzzing()) + m_nRealrowspan = std::min<sal_uInt16>(m_nRealrowspan, SAL_MAX_INT16); m_nRealcolspan = cnumcols; m_pObjStrm->SkipExtra(); |