[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

New commits:
commit 89e9f4984d0dfbc2b69a04e59abc1a3a5d69a0c1
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Feb 15 09:12:40 2018 +0000

    ofz#6366 Integer-overflow
    
    Change-Id: Ic941d48c33211b6b3f225d8a8314f94840f13fb4
    Reviewed-on: https://gerrit.libreoffice.org/49798
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index b88e56badd9d..b64d1b7bc616 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -1465,11 +1465,15 @@ WW8_CP WW8ScannerBase::WW8Fc2Cp( WW8_FC nFcPos ) const
                 bIsUnicode = m_pWw8Fib->m_fExtChar;
             }
 
-            sal_Int32 nLen = nCpEnd - nCpStart;
+            sal_Int32 nLen;
+            if (o3tl::checked_sub(nCpEnd, nCpStart, nLen))
+            {
+                SAL_WARN("sw.ww8", "broken offset, ignoring");
+                return WW8_CP_MAX;
+            }
             if (bIsUnicode)
             {
-                bool bFail = o3tl::checked_multiply<WW8_CP>(nLen, 2, nLen);
-                if (bFail)
+                if (o3tl::checked_multiply<WW8_CP>(nLen, 2, nLen))
                 {
                     SAL_WARN("sw.ww8", "broken offset, ignoring");
                     return WW8_CP_MAX;