From 34a7a7ff426dac55d62fc357cebbc0b22cd65c06 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Mon, 28 Aug 2017 10:53:42 +0100 Subject: ofz#3121 check bounds better MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: Ib1eacda7e4cdf1d0238532f4e38059a9c30556ac Reviewed-on: https://gerrit.libreoffice.org/41626 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- filter/source/graphicfilter/icgm/class4.cxx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'filter') diff --git a/filter/source/graphicfilter/icgm/class4.cxx b/filter/source/graphicfilter/icgm/class4.cxx index 68352bb4e293..c505b39a90cf 100644 --- a/filter/source/graphicfilter/icgm/class4.cxx +++ b/filter/source/graphicfilter/icgm/class4.cxx @@ -186,7 +186,7 @@ void CGM::ImplDoClass4() sal_uInt32 nType = ImplGetUI16(); sal_uInt32 nSize = ImplGetUI( 1 ); - if (static_cast(mpEndValidSource - (mpSource + mnParaSize)) < nSize) + if (static_cast(mpEndValidSource - (mpSource + mnParaSize)) <= nSize) throw css::uno::Exception("attempt to read past end of input", nullptr); mpSource[mnParaSize + nSize] = 0; @@ -224,7 +224,7 @@ void CGM::ImplDoClass4() sal_uInt32 nType = ImplGetUI16(); sal_uInt32 nSize = ImplGetUI(1); - if (static_cast(mpEndValidSource - (mpSource + mnParaSize)) < nSize) + if (static_cast(mpEndValidSource - (mpSource + mnParaSize)) <= nSize) throw css::uno::Exception("attempt to read past end of input", nullptr); mpSource[ mnParaSize + nSize ] = 0; @@ -242,7 +242,7 @@ void CGM::ImplDoClass4() (void)ImplGetUI16(); // nType sal_uInt32 nSize = ImplGetUI( 1 ); - if (static_cast(mpEndValidSource - (mpSource + mnParaSize)) < nSize) + if (static_cast(mpEndValidSource - (mpSource + mnParaSize)) <= nSize) throw css::uno::Exception("attempt to read past end of input", nullptr); mpSource[ mnParaSize + nSize ] = 0; -- cgit