[Libreoffice-commits] core.git: Branch 'libreoffice-6-3' - filter/source

[Caolán McNamara (via logerrit)]

 filter/source/graphicfilter/icgm/cgm.cxx |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit f576e45957a24839d6e75e08e3fb4761e7b0b57e
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Nov 1 17:29:56 2019 +0000
Commit:     Adolfo Jayme Barrientos <fitojb at ubuntu.com>
CommitDate: Tue Nov 5 15:03:07 2019 +0100

    ofz#18646 ensure we are inside valid range
    
    Change-Id: Ide4d4bfad5b365a42790454cca709d175054c933
    Reviewed-on: https://gerrit.libreoffice.org/81909
    Tested-by: Jenkins
    Reviewed-by: Adolfo Jayme Barrientos <fitojb at ubuntu.com>

diff --git a/filter/source/graphicfilter/icgm/cgm.cxx b/filter/source/graphicfilter/icgm/cgm.cxx
index 3004d346522e..8ae42deb1fe8 100644
--- a/filter/source/graphicfilter/icgm/cgm.cxx
+++ b/filter/source/graphicfilter/icgm/cgm.cxx
@@ -97,7 +97,7 @@ sal_uInt8 CGM::ImplGetByte( sal_uInt32 nSource, sal_uInt32 nPrecision )
 sal_Int32 CGM::ImplGetI( sal_uInt32 nPrecision )
 {
     sal_uInt8* pSource = mpSource + mnParaSize;
-    if (static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision)
+    if (pSource > mpEndValidSource || static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision)
         throw css::uno::Exception("attempt to read past end of input", nullptr);
     mnParaSize += nPrecision;
     switch( nPrecision )
@@ -129,7 +129,7 @@ sal_Int32 CGM::ImplGetI( sal_uInt32 nPrecision )
 sal_uInt32 CGM::ImplGetUI( sal_uInt32 nPrecision )
 {
     sal_uInt8* pSource = mpSource + mnParaSize;
-    if (static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision)
+    if (pSource > mpEndValidSource || static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision)
         throw css::uno::Exception("attempt to read past end of input", nullptr);
     mnParaSize += nPrecision;
     switch( nPrecision )