diff options
| -rw-r--r-- | filter/source/graphicfilter/icgm/cgm.cxx | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/filter/source/graphicfilter/icgm/cgm.cxx b/filter/source/graphicfilter/icgm/cgm.cxx index 8122d399eaa6..32f9fca0257b 100644 --- a/filter/source/graphicfilter/icgm/cgm.cxx +++ b/filter/source/graphicfilter/icgm/cgm.cxx @@ -97,7 +97,7 @@ sal_uInt8 CGM::ImplGetByte( sal_uInt32 nSource, sal_uInt32 nPrecision ) sal_Int32 CGM::ImplGetI( sal_uInt32 nPrecision ) { sal_uInt8* pSource = mpSource + mnParaSize; - if (static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision) + if (pSource > mpEndValidSource || static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision) throw css::uno::Exception("attempt to read past end of input", nullptr); mnParaSize += nPrecision; switch( nPrecision ) @@ -129,7 +129,7 @@ sal_Int32 CGM::ImplGetI( sal_uInt32 nPrecision ) sal_uInt32 CGM::ImplGetUI( sal_uInt32 nPrecision ) { sal_uInt8* pSource = mpSource + mnParaSize; - if (static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision) + if (pSource > mpEndValidSource || static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision) throw css::uno::Exception("attempt to read past end of input", nullptr); mnParaSize += nPrecision; switch( nPrecision ) |