[Libreoffice-commits] core.git: sw/source
Caolán McNamara
caolanm at redhat.com
Wed Nov 15 09:00:47 UTC 2017
sw/source/filter/ww8/ww8scan.cxx | 37 +++++++++++++++++++++++++++++++++++--
1 file changed, 35 insertions(+), 2 deletions(-)
New commits:
commit 43e17bdc6efa2ddcb1f08e5d2c40e7dc636c80fb
Author: Caolán McNamara <caolanm at redhat.com>
Date: Tue Nov 14 21:22:13 2017 +0000
ofz#4213 Integer-overflow
Change-Id: Ice22ad92a82971f34c01d2c16fc3d4805b1fd5f3
Reviewed-on: https://gerrit.libreoffice.org/44742
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index e7d37be5fd87..1b24c6686aad 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -1264,8 +1264,41 @@ WW8_CP WW8PLCFx_PCD::AktPieceStartFc2Cp( WW8_FC nStartPos )
if( nStartPos < nFcStart )
nStartPos = nFcStart;
- if( nStartPos >= nFcStart + (nCpEnd - nCpStart) * nUnicodeFactor )
- nStartPos = nFcStart + (nCpEnd - nCpStart - 1) * nUnicodeFactor;
+ WW8_CP nCpLen;
+ bool bFail = o3tl::checked_sub(nCpEnd, nCpStart, nCpLen);
+ if (bFail)
+ {
+ SAL_WARN("sw.ww8", "broken offset, ignoring");
+ return WW8_CP_MAX;
+ }
+
+ WW8_CP nCpLenBytes;
+ bFail = o3tl::checked_multiply(nCpLen, nUnicodeFactor, nCpLenBytes);
+ if (bFail)
+ {
+ SAL_WARN("sw.ww8", "broken offset, ignoring");
+ return WW8_CP_MAX;
+ }
+
+ WW8_FC nFcLen;
+ bFail = o3tl::checked_add(nFcStart, nCpLenBytes, nFcLen);
+ if (bFail)
+ {
+ SAL_WARN("sw.ww8", "broken offset, ignoring");
+ return WW8_CP_MAX;
+ }
+
+ WW8_FC nFcEnd;
+ bFail = o3tl::checked_add(nFcStart, nFcLen, nFcEnd);
+ if (bFail)
+ {
+ SAL_WARN("sw.ww8", "broken offset, ignoring");
+ return WW8_CP_MAX;
+ }
+
+
+ if (nStartPos >= nFcEnd)
+ nStartPos = nFcEnd - (1 * nUnicodeFactor);
return nCpStart + (nStartPos - nFcStart) / nUnicodeFactor;
}
More information about the Libreoffice-commits
mailing list