ofz+ubsan: signed integer overflow

Change-Id: I1484897d5c14cc35165b7bec0b840c03024a34e9
Reviewed-on: https://gerrit.libreoffice.org/43519
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 8 insertions, 0 deletions

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index b3fdcd08ce04..b3bdaa01bcca 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -3654,6 +3654,14 @@ void WW8PLCFx_SubDoc::GetSprms(WW8PLCFxDesc* p)
         return;
     }
 
+    if (p->nCp2OrIdx < 0 || p->nCp2OrIdx > p->nSprmsLen)
+    {
+        SAL_WARN("sw.ww8", "Document has invalid Cp or Idx, ignoring it");
+        p->nEndPos = p->nStartPos = WW8_CP_MAX;
+        p->nSprmsLen = 0;
+        return;
+    }
+
     p->nSprmsLen -= p->nCp2OrIdx;
 }