[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

New commits:
commit c15ac2c2ce71e35fd026109231444f5fb5745851
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Oct 26 09:42:48 2017 +0100

    ofz#3813 Integer-overflow
    
    Change-Id: Ibc14583137aae0d46e501927e602a510339abe38
    Reviewed-on: https://gerrit.libreoffice.org/43872
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index f296eb91af04..5e6fa76aa4d0 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -7294,7 +7294,14 @@ bool WW8PLCF_HdFt::GetTextPos(sal_uInt8 grpfIhdt, sal_uInt8 nWhich, WW8_CP& rSta
         SAL_WARN("sw.ww8", "End " << nEnd << " before Start " << rStart);
         return false;
     }
-    rLen = nEnd - rStart;
+
+    bool bFail = o3tl::checked_sub(nEnd, rStart, rLen);
+    if (bFail)
+    {
+        SAL_WARN("sw.ww8", "broken offset, ignoring");
+        return false;
+    }
+
     aPLCF.advance();
 
     return true;