[Libreoffice-commits] core.git: lotuswordpro/source

[Stephan Bergmann]

 lotuswordpro/source/filter/lwpparaborderoverride.cxx |   23 +++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

New commits:
commit 9d1c8e66f7020fa0150b23bd450e514f848bd20b
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Tue Apr 5 12:35:54 2016 +0200

    UBSan: Restrict BorderWidthType values to valid range on input
    
    ...lotuswordpro/qa/cppunit/data/fail/null-1.lwp would read 15 into m_eBelowType
    
    Change-Id: Icedcb4c8e2e6309b2e1bd82025feb02bad1ab7da

diff --git a/lotuswordpro/source/filter/lwpparaborderoverride.cxx b/lotuswordpro/source/filter/lwpparaborderoverride.cxx
index 67398f1..7f0873a 100644
--- a/lotuswordpro/source/filter/lwpparaborderoverride.cxx
+++ b/lotuswordpro/source/filter/lwpparaborderoverride.cxx
@@ -124,6 +124,21 @@ LwpParaBorderOverride* LwpParaBorderOverride::clone() const
     return new LwpParaBorderOverride(*this);
 }
 
+namespace {
+
+LwpParaBorderOverride::BorderWidthType readBorderWidthType(
+    LwpObjectStream * stream)
+{
+    sal_uInt16 n = stream->QuickReaduInt16();
+    if (n > LwpParaBorderOverride::PB_CUSTOMWIDTH) {
+        SAL_WARN("lwp", "bad BorderWidthType " << n);
+        n = LwpParaBorderOverride::PB_NONE;
+    }
+    return static_cast<LwpParaBorderOverride::BorderWidthType>(n);
+}
+
+}
+
 void LwpParaBorderOverride::Read(LwpObjectStream *pStrm)
 {
     if (pStrm->QuickReadBool())
@@ -134,15 +149,15 @@ void LwpParaBorderOverride::Read(LwpObjectStream *pStrm)
         m_pShadow->Read(pStrm);
         m_pMargins->Read(pStrm);
 
-        m_eAboveType = static_cast<BorderWidthType>(pStrm->QuickReaduInt16());
-        m_eBelowType = static_cast<BorderWidthType>(pStrm->QuickReaduInt16());
-        m_eRightType = static_cast<BorderWidthType>(pStrm->QuickReaduInt16());
+        m_eAboveType = readBorderWidthType(pStrm);
+        m_eBelowType = readBorderWidthType(pStrm);
+        m_eRightType = readBorderWidthType(pStrm);
 
         if( pStrm->CheckExtra() )
         {
             m_pBetweenStuff->Read(pStrm);
 
-            m_eBetweenType = static_cast<BorderWidthType>(pStrm->QuickReaduInt16());
+            m_eBetweenType = readBorderWidthType(pStrm);
             m_nBetweenWidth = pStrm->QuickReaduInt32();
             m_nBetweenMargin = pStrm->QuickReaduInt32();