[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

New commits:
commit dbe1ba336130d51054172f82440c13c933f719e0
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Oct 25 09:32:51 2017 +0100

    ofz#3784 Integer-overflow
    
    Change-Id: I90e2377fa828a8ffe2c3e3d0385caa2e6910ef02
    Reviewed-on: https://gerrit.libreoffice.org/43809
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 12cb59cd2698..684c9a00a2be 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -1926,9 +1926,12 @@ sal_Int32 WW8ScannerBase::WW8ReadString( SvStream& rStrm, OUString& rStr,
     // Read in plain text, which can extend over several pieces
     rStr.clear();
 
-    long nTotalRead = 0;
+    if (nAktStartCp < 0 || nTotalLen < 0)
+        return 0;
+
     WW8_CP nBehindTextCp = nAktStartCp + nTotalLen;
     WW8_CP nNextPieceCp  = nBehindTextCp; // Initialization, important for Ver6
+    long nTotalRead = 0;
     do
     {
         bool bIsUnicode(false), bPosOk(false);