diff options
| -rw-r--r-- | filter/source/graphicfilter/icgm/class1.cxx | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/filter/source/graphicfilter/icgm/class1.cxx b/filter/source/graphicfilter/icgm/class1.cxx index 0d297bbe0a10..895dd8247d0b 100644 --- a/filter/source/graphicfilter/icgm/class1.cxx +++ b/filter/source/graphicfilter/icgm/class1.cxx @@ -192,6 +192,10 @@ void CGM::ImplDoClass1() { sal_uInt32 nCharSetType = ImplGetUI16(); sal_uInt32 nSize = ImplGetUI(1); + + if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize) + throw css::uno::Exception("attempt to read past end of input", nullptr); + pElement->aFontList.InsertCharSet( (CharSetType)nCharSetType, mpSource + mnParaSize, nSize ); mnParaSize += nSize; } |