[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8par2.cxx |    8 ++++++++
 1 file changed, 8 insertions(+)

New commits:
commit 98151bf95bda8d647310bdba6936dc6b388b05de
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Apr 4 19:13:12 2017 +0100

    ofz: check olst sprm for valid ANLD payload len
    
    Change-Id: Ic1b6681a3f48ef0fe3f52eda9db8b7bc003ded55

diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index 67a7b05c5f12..18829c483951 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -950,6 +950,14 @@ void SwWW8ImplReader::Read_OLST( sal_uInt16, const sal_uInt8* pData, short nLen
         m_pNumOlst = nullptr;
         return;
     }
+
+    if (static_cast<size_t>(nLen) < sizeof(WW8_OLST))
+    {
+        SAL_WARN("sw.ww8", "WW8_OLST property is " << nLen << " long, needs to be at least " << sizeof(WW8_OLST));
+        m_pNumOlst = nullptr;
+        return;
+    }
+
     m_pNumOlst = new WW8_OLST;
     if( nLen < sal::static_int_cast< sal_Int32 >(sizeof( WW8_OLST )) )   // fill if to short
         memset( m_pNumOlst, 0, sizeof( *m_pNumOlst ) );