[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

New commits:
commit 71518d1898e574351dab4513a2d55bbed2b47fe3
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Oct 25 15:34:47 2017 +0100

    ofz Integer overflow
    
    Change-Id: I4ee001f2f587612f0a924e02f4f3fae4c7afbe75
    Reviewed-on: https://gerrit.libreoffice.org/43844
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 3a3030945306..3055feca08a5 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -3388,7 +3388,13 @@ void WW8PLCFx_Cp_FKP::GetSprms(WW8PLCFxDesc* p)
                                     continue;
                                 }
                             }
-                            nLimitFC = nFcStart + nCpLen;
+
+                            const bool bFail = o3tl::checked_add(nFcStart, nCpLen, nLimitFC);
+                            if (bFail)
+                            {
+                                SAL_WARN("sw.ww8", "broken offset, ignoring");
+                                continue;
+                            }
 
                             //if it doesn't exist, skip it
                             if (!SeekPos(nCpStart))