[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |    8 ++++++++
 1 file changed, 8 insertions(+)

New commits:
commit f9ffe96b84044e28c58b48d57662c7db3d50bcc0
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Oct 18 21:25:24 2017 +0100

    ofz+ubsan: signed integer overflow
    
    Change-Id: I1484897d5c14cc35165b7bec0b840c03024a34e9
    Reviewed-on: https://gerrit.libreoffice.org/43519
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index b3fdcd08ce04..b3bdaa01bcca 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -3654,6 +3654,14 @@ void WW8PLCFx_SubDoc::GetSprms(WW8PLCFxDesc* p)
         return;
     }
 
+    if (p->nCp2OrIdx < 0 || p->nCp2OrIdx > p->nSprmsLen)
+    {
+        SAL_WARN("sw.ww8", "Document has invalid Cp or Idx, ignoring it");
+        p->nEndPos = p->nStartPos = WW8_CP_MAX;
+        p->nSprmsLen = 0;
+        return;
+    }
+
     p->nSprmsLen -= p->nCp2OrIdx;
 }