diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-10-18 14:26:13 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-10-18 21:43:43 +0200 |
| commit | 86ed57911dffae4757058c410e4c5ac88ee8b160 (patch) | |
| tree | aad116e3ad3823bea2c9463c9d9271d0d14ffbda /sw | |
| parent | 3db8059cd92545a618e6ec349b090b569c60847d (diff) | |
ofz+ubsan: signed integer overflow
sw/source/filter/ww8/ww8scan.cxx:1816:15: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Change-Id: I8dc79794c94c512ed1f73ea3f0e251cf2dc960bc
Reviewed-on: https://gerrit.libreoffice.org/43505
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/filter/ww8/ww8scan.cxx | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index 402319bce5cb..b3fdcd08ce04 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -1811,6 +1811,9 @@ static bool WW8GetFieldPara(WW8PLCFspecial& rPLCF, WW8FieldDesc& rF) if( !rPLCF.Get( rF.nLCode, pData ) ) goto Err; + if (rF.nLCode < rF.nSCode) + goto Err; + rF.nSRes = rF.nLCode; // Default rF.nSCode++; // without markers rF.nLCode -= rF.nSCode; // Pos -> length |