[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - filter/source

[Caolán McNamara]

 filter/source/graphicfilter/icgm/class4.cxx |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

New commits:
commit b72dee386ac15a7fd6098503772e606c5f059a20
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 28 10:53:42 2017 +0100

    ofz#3121 check bounds better
    
    Change-Id: Ib1eacda7e4cdf1d0238532f4e38059a9c30556ac
    Reviewed-on: https://gerrit.libreoffice.org/41628
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/filter/source/graphicfilter/icgm/class4.cxx b/filter/source/graphicfilter/icgm/class4.cxx
index ff574c4eece4..e97781d314e7 100644
--- a/filter/source/graphicfilter/icgm/class4.cxx
+++ b/filter/source/graphicfilter/icgm/class4.cxx
@@ -186,7 +186,7 @@ void CGM::ImplDoClass4()
                 sal_uInt32 nType = ImplGetUI16( 4 );
                 sal_uInt32 nSize = ImplGetUI( 1 );
 
-                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
+                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
                     throw css::uno::Exception("attempt to read past end of input", nullptr);
 
                 mpSource[mnParaSize + nSize] = 0;
@@ -224,7 +224,7 @@ void CGM::ImplDoClass4()
                 sal_uInt32 nType = ImplGetUI16(4);
                 sal_uInt32 nSize = ImplGetUI(1);
 
-                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
+                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
                     throw css::uno::Exception("attempt to read past end of input", nullptr);
 
                 mpSource[ mnParaSize + nSize ] = 0;
@@ -242,7 +242,7 @@ void CGM::ImplDoClass4()
                 sal_uInt32 nType = ImplGetUI16( 4 );
                 sal_uInt32 nSize = ImplGetUI( 1 );
 
-                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
+                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
                     throw css::uno::Exception("attempt to read past end of input", nullptr);
 
                 mpSource[ mnParaSize + nSize ] = 0;