[Libreoffice-commits] core.git: lotuswordpro/source

[Caolán McNamara]

 lotuswordpro/source/filter/lwpgrfobj.cxx |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

New commits:
commit 2546ca9dded58cfde5a4c35a3fde69ac3f27a767
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 13 09:20:25 2016 +0100

    coverity#1372879 Integer overflowed argument
    
    Change-Id: I9e5115a00781d07c9c57e39854d6e1482bd02795

diff --git a/lotuswordpro/source/filter/lwpgrfobj.cxx b/lotuswordpro/source/filter/lwpgrfobj.cxx
index df843a9..9d8903c 100644
--- a/lotuswordpro/source/filter/lwpgrfobj.cxx
+++ b/lotuswordpro/source/filter/lwpgrfobj.cxx
@@ -680,17 +680,23 @@ void LwpGraphicObject::XFConvertEquation(XFContentContainer * pCont)
         //                                18,12,0,0,0,0,0.
         //                                 .TCIformat{2}
         //total head length = 45
+        bool bOk = true;
         sal_uInt32 nBegin = 45;
-        sal_uInt32 nEnd = nDataLen -1;
+        sal_uInt32 nEnd = 0;
+        if (nDataLen >= 1)
+            nEnd = nDataLen - 1;
+        else
+            bOk = false;
 
-        if(pGrafData[nEnd] == '$' && pGrafData[nEnd-1]!= '\\')
+        if (bOk && pGrafData[nEnd] == '$' && nEnd > 0 && pGrafData[nEnd-1] != '\\')
         {
             //equation body is contained by '$';
             nBegin++;
             nEnd--;
         }
 
-        if(nEnd >= nBegin)
+        bOk &= nEnd >= nBegin;
+        if (bOk)
         {
             sal_uInt8* pEquData = new sal_uInt8[nEnd - nBegin + 1];
             for(sal_uInt32 nIndex = 0; nIndex < nEnd - nBegin +1 ; nIndex++)