[Libreoffice-commits] core.git: Branch 'libreoffice-6-3' - filter/source

[Caolán McNamara (via logerrit)]

 filter/source/graphicfilter/icgm/class7.cxx |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

New commits:
commit 08cb6ed14be3c2b71377a9d16ad0f19086278362
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Dec 2 13:03:48 2019 +0000
Commit:     Michael Stahl <michael.stahl at cib.de>
CommitDate: Tue Dec 3 11:03:54 2019 +0100

    ofz#19207 check max strlen possible
    
    Change-Id: I5fe9fde240ef375d9de097dda47953320ecc758d
    Reviewed-on: https://gerrit.libreoffice.org/84255
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.stahl at cib.de>

diff --git a/filter/source/graphicfilter/icgm/class7.cxx b/filter/source/graphicfilter/icgm/class7.cxx
index c85e5284e026..8c2478a308ae 100644
--- a/filter/source/graphicfilter/icgm/class7.cxx
+++ b/filter/source/graphicfilter/icgm/class7.cxx
@@ -127,9 +127,11 @@ void CGM::ImplDoClass7()
                         nAttributes >>= 12;
                         pTextEntry->nAttributes = nAttributes;
                         pAppData += 8;
-                        sal_uInt32 nLen = strlen( reinterpret_cast<char*>( pAppData ) ) + 1;
-                        pTextEntry->pText = new char[ nLen ];
+                        auto nMaxLen = mpEndValidSource - pAppData;
+                        sal_uInt32 nLen = strnlen(reinterpret_cast<char*>(pAppData), nMaxLen);
+                        pTextEntry->pText = new char[nLen + 1];
                         memcpy( pTextEntry->pText, pAppData, nLen );
+                        pTextEntry->pText[nLen] = 0;
                         pAppData += nLen;
 
                         mpChart->InsertTextEntry( std::move(pTextEntry) );