[Libreoffice-commits] core.git: sw/source

[Caolán McNamara (via logerrit)]

 sw/source/filter/ww8/ww8scan.cxx |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit 44c63c0ba1eb491a9a2d8842badd1a5fc49376fd
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Mar 23 15:24:35 2019 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Sat Mar 23 20:12:24 2019 +0100

    ofz#13881 Integer OverfloW
    
    Change-Id: I90dc8be47cff080bc4e8242c2ae0961c2bc92aba
    Reviewed-on: https://gerrit.libreoffice.org/69588
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index c2708708bd41..c2a43bab3d5e 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2021,7 +2021,11 @@ static bool WW8GetFieldPara(WW8PLCFspecial& rPLCF, WW8FieldDesc& rF)
             goto Err;
         }
         rF.nLRes -= rF.nSRes;                       // now: nLRes = length
-        rF.nSRes++;                                 // Endpos including Markers
+        if (o3tl::checked_add<WW8_CP>(rF.nSRes, 1, rF.nSRes)) // Endpos including Markers
+        {
+            rF.nLen = 0;
+            goto Err;
+        }
         rF.nLRes--;
     }else{
         rF.nLRes = 0;                               // no result found