diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-10-18 21:25:24 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-10-19 09:58:46 +0200 |
| commit | f9ffe96b84044e28c58b48d57662c7db3d50bcc0 (patch) | |
| tree | 4016d918e10e7a5d6bdba35d9c862610e6bae87a /sw | |
| parent | 40d663adac040a419b3ac3a303958ba49bc8712e (diff) | |
ofz+ubsan: signed integer overflow
Change-Id: I1484897d5c14cc35165b7bec0b840c03024a34e9
Reviewed-on: https://gerrit.libreoffice.org/43519
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/filter/ww8/ww8scan.cxx | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index b3fdcd08ce04..b3bdaa01bcca 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -3654,6 +3654,14 @@ void WW8PLCFx_SubDoc::GetSprms(WW8PLCFxDesc* p) return; } + if (p->nCp2OrIdx < 0 || p->nCp2OrIdx > p->nSprmsLen) + { + SAL_WARN("sw.ww8", "Document has invalid Cp or Idx, ignoring it"); + p->nEndPos = p->nStartPos = WW8_CP_MAX; + p->nSprmsLen = 0; + return; + } + p->nSprmsLen -= p->nCp2OrIdx; } |