[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

New commits:
commit f05130c20c90c47f98941c06f056563315b2c1e4
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Nov 17 16:16:36 2017 +0000

    ofz: Integer-overflow
    
    Change-Id: I8a1a8c4b4d5f32a1f2b8a2e03225f6ac6b747232
    Reviewed-on: https://gerrit.libreoffice.org/44889
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 1b24c6686aad..a561a702f324 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -1300,7 +1300,17 @@ WW8_CP WW8PLCFx_PCD::AktPieceStartFc2Cp( WW8_FC nStartPos )
     if (nStartPos >= nFcEnd)
         nStartPos = nFcEnd - (1 * nUnicodeFactor);
 
-    return nCpStart + (nStartPos - nFcStart) / nUnicodeFactor;
+    WW8_FC nFcDiff = (nStartPos - nFcStart) / nUnicodeFactor;
+
+    WW8_FC nCpRet;
+    bFail = o3tl::checked_add(nCpStart, nFcDiff, nCpRet);
+    if (bFail)
+    {
+        SAL_WARN("sw.ww8", "broken offset, ignoring");
+        return WW8_CP_MAX;
+    }
+
+    return nCpRet;
 }
 
 //      Helper routines for all