From 1f7ae933a62742d7626859a00750f795551843f3 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Sun, 9 Jan 2022 16:16:39 +0000 Subject: ofz#43458 avoid OOM MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: Id0e1e985c446c147a219ba2f5157a41deae656a4 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128193 Tested-by: Jenkins Reviewed-by: Caolán McNamara (cherry picked from commit e28f4b6bccafb2b9f3c44dfabf36d1b822d85f84) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128235 Reviewed-by: Xisco Fauli --- lotuswordpro/source/filter/lwpdrawobj.cxx | 2 ++ 1 file changed, 2 insertions(+) (limited to 'lotuswordpro/source') diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index 5245bfd93ddc..d6255b2e63d7 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -1047,6 +1047,8 @@ void LwpDrawTextBox::Read() // the 71 is the fixed length before text content in textbox record sal_Int16 TextLength = m_aObjHeader.nRecLen - 71; + if (TextLength < 0) + throw BadRead(); m_aTextRec.pTextString = new sal_uInt8 [TextLength]; m_pStream->ReadBytes(m_aTextRec.pTextString, TextLength); -- cgit