diff options
| -rw-r--r-- | sw/source/filter/ww8/ww8scan.cxx | 19 |
1 files changed, 16 insertions, 3 deletions
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index 3055feca08a5..c3adbf485d8f 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -1509,17 +1509,30 @@ WW8_FC WW8ScannerBase::WW8Cp2Fc(WW8_CP nCpPos, bool* pIsUnicode, else *pIsUnicode = m_pWw8Fib->m_fExtChar; - WW8_CP nCpLen = nCpPos - nCpStart; + WW8_CP nCpLen; + bool bFail = o3tl::checked_sub(nCpPos, nCpStart, nCpLen); + if (bFail) + { + SAL_WARN("sw.ww8", "broken offset, ignoring"); + return WW8_CP_MAX; + } + if (*pIsUnicode) { - const bool bFail = o3tl::checked_multiply<WW8_CP>(nCpLen, 2, nCpLen); + bFail = o3tl::checked_multiply<WW8_CP>(nCpLen, 2, nCpLen); if (bFail) { SAL_WARN("sw.ww8", "broken offset, ignoring"); return WW8_CP_MAX; } } - nRet += nCpLen; + + bFail = o3tl::checked_add(nRet, nCpLen, nRet); + if (bFail) + { + SAL_WARN("sw.ww8", "broken offset, ignoring"); + return WW8_CP_MAX; + } return nRet; } |