[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

New commits:
commit 0f6494082983773431c84a3fcfd38db93d6afdae
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Oct 19 09:41:35 2017 +0100

    ofz+ubsan: signed integer overflow
    
    Change-Id: I950fb60f9bc7d86a2fe6c64a3d8e62d29ab29817
    Reviewed-on: https://gerrit.libreoffice.org/43538
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index b3bdaa01bcca..446976f9ce35 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2081,7 +2081,13 @@ WW8PLCF::WW8PLCF(SvStream& rSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
     WW8_CP nStartPos, sal_Int32 nPN, sal_Int32 ncpN): pPLCF_PosArray(nullptr), nIdx(0),
     nStru(nStruct)
 {
-    nIMax = ( nPLCF - 4 ) / ( 4 + nStruct );
+    if (nPLCF < 0)
+    {
+        SAL_WARN("sw.ww8", "broken WW8PLCF, ignoring");
+        nIMax = SAL_MAX_INT32;
+    }
+    else
+        nIMax = (nPLCF - 4) / (4 + nStruct);
 
     if( nIMax >= ncpN )
         ReadPLCF(rSt, nFilePos, nPLCF);