[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

New commits:
commit fcf042b2163c29cdd426c7947fd55937981162b3
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Dec 2 09:25:27 2016 +0000

    coverity#1394416 try and get it to see this bounds check
    
    Change-Id: I007e9fb717d0da60c00aa14a4856075a6092148e

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 8b27a3f..c8c5a38 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2550,11 +2550,12 @@ WW8PLCFx_Fc_FKP::WW8Fkp::WW8Fkp(const WW8Fib& rFib, SvStream* pSt,
                          of the new data
                         */
                         bool bExpand = IsExpandableSprm(nSpId);
-                        const void* pEndAvailableData = maRawData + sizeof(maRawData);
-                        if ((IsReplaceAllSprm(nSpId) || bExpand) && aEntry.mpData + 2 + sizeof(sal_uInt32) <= pEndAvailableData)
+                        const sal_uInt8* pStartData = aEntry.mpData + 2;
+                        const sal_uInt8* pLastValidDataPos = maRawData + sizeof(maRawData) - sizeof(sal_uInt32);
+                        if ((IsReplaceAllSprm(nSpId) || bExpand) && pStartData <= pLastValidDataPos)
                         {
                             sal_uInt32 nCurr = pDataSt->Tell();
-                            sal_uInt32 nPos = SVBT32ToUInt32(aEntry.mpData + 2);
+                            sal_uInt32 nPos = SVBT32ToUInt32(pStartData);
                             sal_uInt16 nLen(0);
 
                             bool bOk = checkSeek(*pDataSt, nPos);