From e9c9e71211de4528ca0bb000c17202ede7c6d5c6 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Wed, 30 Dec 2020 21:19:15 +0000
Subject: ofz#29113 short read

Change-Id: I107d8abeac419ba4e70a5880054c9195c60464ad
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/108350
Tested-by: Jenkins
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
---
 vcl/source/gdi/jobset.cxx | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/vcl/source/gdi/jobset.cxx b/vcl/source/gdi/jobset.cxx
index a382dc6a062d..5777e1faa044 100644
--- a/vcl/source/gdi/jobset.cxx
+++ b/vcl/source/gdi/jobset.cxx
@@ -266,6 +266,13 @@ SvStream& ReadJobSetup( SvStream& rIStream, JobSetup& rJobSetup )
             if ( nSystem == JOBSET_FILE364_SYSTEM ||
                  nSystem == JOBSET_FILE605_SYSTEM )
             {
+                if (nRead < sizeof(ImplOldJobSetupData) + sizeof(Impl364JobSetupData))
+                {
+                    SAL_WARN("vcl", "Parsing error: " << sizeof(ImplOldJobSetupData) + sizeof(Impl364JobSetupData) <<
+                             " required, but " << nRead << " available");
+                    return rIStream;
+                }
+
                 Impl364JobSetupData* pOldJobData    = reinterpret_cast<Impl364JobSetupData*>(pTempBuf.get() + sizeof( ImplOldJobSetupData ));
                 sal_uInt16 nOldJobDataSize          = SVBT16ToUInt16( pOldJobData->nSize );
                 rJobData.SetSystem( SVBT16ToUInt16( pOldJobData->nSystem ) );
-- 
cgit