[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

New commits:
commit 6b61c3f7fdcdd8721bf51c39fdcce7e9851a6686
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Oct 31 08:49:39 2017 +0000

    ofz#3935 Integer-overflow
    
    Change-Id: I2f79eaf7887b48a6aab2041ac7949a62c4bce256
    Reviewed-on: https://gerrit.libreoffice.org/44101
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 3f5d39c8f3c8..4afa6b66a32b 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2235,11 +2235,17 @@ void WW8PLCF::GeneratePLCF(SvStream& rSt, sal_Int32 nPN, sal_Int32 ncpN)
     bool failure = false;
     nIMax = ncpN;
 
-    if ((nIMax < 1) || (nIMax > (WW8_CP_MAX - 4) / (4 + nStru)) || ((nPN + ncpN) > USHRT_MAX) || nPN < 0)
+    if ((nIMax < 1) || (nIMax > (WW8_CP_MAX - 4) / (4 + nStru)) || nPN < 0)
         failure = true;
 
     if (!failure)
     {
+        sal_Int32 nResult;
+        failure = o3tl::checked_add(nPN, ncpN, nResult) || nResult > USHRT_MAX;
+    }
+
+    if (!failure)
+    {
         size_t nSiz = (4 + nStru) * nIMax + 4;
         size_t nElems = ( nSiz + 3 ) / 4;
         pPLCF_PosArray.reset( new sal_Int32[ nElems ] ); // Pointer to Pos-array