summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--filter/source/graphicfilter/icgm/class4.cxx6
1 files changed, 3 insertions, 3 deletions
diff --git a/filter/source/graphicfilter/icgm/class4.cxx b/filter/source/graphicfilter/icgm/class4.cxx
index 68352bb4e293..c505b39a90cf 100644
--- a/filter/source/graphicfilter/icgm/class4.cxx
+++ b/filter/source/graphicfilter/icgm/class4.cxx
@@ -186,7 +186,7 @@ void CGM::ImplDoClass4()
sal_uInt32 nType = ImplGetUI16();
sal_uInt32 nSize = ImplGetUI( 1 );
- if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
+ if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
throw css::uno::Exception("attempt to read past end of input", nullptr);
mpSource[mnParaSize + nSize] = 0;
@@ -224,7 +224,7 @@ void CGM::ImplDoClass4()
sal_uInt32 nType = ImplGetUI16();
sal_uInt32 nSize = ImplGetUI(1);
- if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
+ if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
throw css::uno::Exception("attempt to read past end of input", nullptr);
mpSource[ mnParaSize + nSize ] = 0;
@@ -242,7 +242,7 @@ void CGM::ImplDoClass4()
(void)ImplGetUI16(); // nType
sal_uInt32 nSize = ImplGetUI( 1 );
- if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
+ if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
throw css::uno::Exception("attempt to read past end of input", nullptr);
mpSource[ mnParaSize + nSize ] = 0;