From a1ee7a24b1b02553ac02be14f7fe6b06359ed3fd Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Mon, 25 Sep 2017 21:32:27 +0100
Subject: check sot multiply
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I9d1e86834af87cd92c2792f66ac722ba94dff040
Reviewed-on: https://gerrit.libreoffice.org/42768
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 sot/source/sdstor/stgstrms.cxx | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'sot')

diff --git a/sot/source/sdstor/stgstrms.cxx b/sot/source/sdstor/stgstrms.cxx
index 1ecdc042f351..f449874b3b10 100644
--- a/sot/source/sdstor/stgstrms.cxx
+++ b/sot/source/sdstor/stgstrms.cxx
@@ -21,6 +21,7 @@
 
 #include <string.h>
 #include <sal/log.hxx>
+#include <o3tl/safeint.hxx>
 #include <osl/file.hxx>
 #include <unotools/tempfile.hxx>
 #include <set>
@@ -1070,7 +1071,12 @@ sal_Int32 StgSmallStrm::Read( void* pBuf, sal_Int32 n )
             nBytes = (short) n;
         if( nBytes )
         {
-            if( !m_pData || !m_pData->Pos2Page( m_nPage * m_nPageSize + m_nOffset ) )
+            if (!m_pData)
+                break;
+            sal_Int32 nPos;
+            if (o3tl::checked_multiply<sal_Int32>(m_nPage, m_nPageSize, nPos))
+                break;
+            if (!m_pData->Pos2Page(nPos + m_nOffset))
                 break;
             // all reading through the stream
             short nRes = (short) m_pData->Read( static_cast<sal_uInt8*>(pBuf) + nDone, nBytes );
-- 
cgit