From 016e4d0e2650b2fb350068d86e8d392a7ef5acb1 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Fri, 12 May 2017 11:38:22 +0100 Subject: ofz: sanity check L_VAR2 record bounds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: I862457a7239108974f360a87b4f6ccf433eae364 Reviewed-on: https://gerrit.libreoffice.org/37534 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- sw/source/filter/ww8/ww8scan.cxx | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'sw') diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index 04060366a1c1..b8b5eac1853e 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -7956,10 +7956,21 @@ sal_uInt16 wwSprmParser::GetSprmTailLen(sal_uInt16 nId, const sal_uInt8* pSprm, nL = static_cast< sal_uInt16 >(pSprm[1 + mnDelta] + aSprm.nLen); break; case L_VAR2: + { // Variable 2-Byte Length? // Excl. Token + Var-Lengthbyte - nL = static_cast< sal_uInt16 >(SVBT16ToShort( &pSprm[1 + mnDelta] ) + aSprm.nLen - 1); + sal_uInt8 nIndex = 1 + mnDelta; + sal_uInt16 nCount; + if (nIndex + 1 >= nRemLen) + { + SAL_WARN("sw.ww8", "sprm longer than remaining bytes, doc or parser is wrong"); + nCount = 0; + } + else + nCount = SVBT16ToShort(&pSprm[nIndex]); + nL = static_cast< sal_uInt16 >(nCount + aSprm.nLen - 1); break; + } default: OSL_ENSURE(false, "Unknown sprm variant"); break; -- cgit