[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/filter/svm/SvmReader.cxx |    2 ++
 1 file changed, 2 insertions(+)

New commits:
commit 960ce1ebafda0eaff0633f10c0fea7b3af703f9a
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Jul 13 10:11:17 2021 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Tue Jul 13 12:46:55 2021 +0200

    cid#1487034 Untrusted value as argument
    
    Change-Id: I5611098c9bd952ca2f3df7951d02de26cfec149e
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118824
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/source/filter/svm/SvmReader.cxx b/vcl/source/filter/svm/SvmReader.cxx
index c51b0cd3815f..04c89af445d1 100644
--- a/vcl/source/filter/svm/SvmReader.cxx
+++ b/vcl/source/filter/svm/SvmReader.cxx
@@ -699,6 +699,7 @@ rtl::Reference<MetaAction> SvmReader::TextArrayHandler(ImplMetaReadData* pData)
     if (nTmpLen > aStr.getLength() - nTmpIndex)
     {
         pAction->SetIndex(0);
+        pAction->SetLen(aStr.getLength());
         return pAction;
     }
 
@@ -735,6 +736,7 @@ rtl::Reference<MetaAction> SvmReader::TextArrayHandler(ImplMetaReadData* pData)
         if (nTmpIndex + nTmpLen > aStr.getLength())
         {
             pAction->SetIndex(0);
+            pAction->SetLen(aStr.getLength());
             aArray.reset();
         }
     }