[Libreoffice-commits] core.git: Branch 'libreoffice-6-4' - filter/source

[Caolán McNamara (via logerrit)]

 filter/source/graphicfilter/icgm/class7.cxx |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

New commits:
commit 3fa8ee239b9d2455c0d5dcc016ce973b7f6acf8d
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Dec 2 13:03:48 2019 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Mon Dec 2 21:33:25 2019 +0100

    ofz#19207 check max strlen possible
    
    Change-Id: I5fe9fde240ef375d9de097dda47953320ecc758d
    Reviewed-on: https://gerrit.libreoffice.org/84253
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/icgm/class7.cxx b/filter/source/graphicfilter/icgm/class7.cxx
index c85e5284e026..8c2478a308ae 100644
--- a/filter/source/graphicfilter/icgm/class7.cxx
+++ b/filter/source/graphicfilter/icgm/class7.cxx
@@ -127,9 +127,11 @@ void CGM::ImplDoClass7()
                         nAttributes >>= 12;
                         pTextEntry->nAttributes = nAttributes;
                         pAppData += 8;
-                        sal_uInt32 nLen = strlen( reinterpret_cast<char*>( pAppData ) ) + 1;
-                        pTextEntry->pText = new char[ nLen ];
+                        auto nMaxLen = mpEndValidSource - pAppData;
+                        sal_uInt32 nLen = strnlen(reinterpret_cast<char*>(pAppData), nMaxLen);
+                        pTextEntry->pText = new char[nLen + 1];
                         memcpy( pTextEntry->pText, pAppData, nLen );
+                        pTextEntry->pText[nLen] = 0;
                         pAppData += nLen;
 
                         mpChart->InsertTextEntry( std::move(pTextEntry) );