[Libreoffice-commits] core.git: sot/source

[Caolán McNamara]

 sot/source/sdstor/stgstrms.cxx |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

New commits:
commit a1ee7a24b1b02553ac02be14f7fe6b06359ed3fd
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Sep 25 21:32:27 2017 +0100

    check sot multiply
    
    Change-Id: I9d1e86834af87cd92c2792f66ac722ba94dff040
    Reviewed-on: https://gerrit.libreoffice.org/42768
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sot/source/sdstor/stgstrms.cxx b/sot/source/sdstor/stgstrms.cxx
index 1ecdc042f351..f449874b3b10 100644
--- a/sot/source/sdstor/stgstrms.cxx
+++ b/sot/source/sdstor/stgstrms.cxx
@@ -21,6 +21,7 @@
 
 #include <string.h>
 #include <sal/log.hxx>
+#include <o3tl/safeint.hxx>
 #include <osl/file.hxx>
 #include <unotools/tempfile.hxx>
 #include <set>
@@ -1070,7 +1071,12 @@ sal_Int32 StgSmallStrm::Read( void* pBuf, sal_Int32 n )
             nBytes = (short) n;
         if( nBytes )
         {
-            if( !m_pData || !m_pData->Pos2Page( m_nPage * m_nPageSize + m_nOffset ) )
+            if (!m_pData)
+                break;
+            sal_Int32 nPos;
+            if (o3tl::checked_multiply<sal_Int32>(m_nPage, m_nPageSize, nPos))
+                break;
+            if (!m_pData->Pos2Page(nPos + m_nOffset))
                 break;
             // all reading through the stream
             short nRes = (short) m_pData->Read( static_cast<sal_uInt8*>(pBuf) + nDone, nBytes );