[Libreoffice-commits] core.git: Branch 'libreoffice-7-1' - hwpfilter/source

[Caolán McNamara (via logerrit)]

 hwpfilter/source/hiodev.cxx |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit c847acd6f2a97dc495741efc4beecd1d6546fb0e
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Mar 26 09:26:10 2021 +0000
Commit:     Andras Timar <andras.timar at collabora.com>
CommitDate: Sun Mar 28 19:47:20 2021 +0200

    ofz#32499 overflowing pos
    
    Change-Id: I164537acbb4d4bcf7dee51a029ffb518a3687fda
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113121
    Tested-by: Jenkins
    Reviewed-by: Andras Timar <andras.timar at collabora.com>

diff --git a/hwpfilter/source/hiodev.cxx b/hwpfilter/source/hiodev.cxx
index 56d4719e4302..a9bd14b57b11 100644
--- a/hwpfilter/source/hiodev.cxx
+++ b/hwpfilter/source/hiodev.cxx
@@ -337,7 +337,7 @@ size_t HMemIODev::readBlock(void *p, size_t size)
 {
     if (state())
         return 0;
-    if (length < pos + size)
+    if (size > length - pos)
         size = length - pos;
     memcpy(p, ptr + pos, size);
     pos += size;
@@ -346,7 +346,7 @@ size_t HMemIODev::readBlock(void *p, size_t size)
 
 size_t HMemIODev::skipBlock(size_t size)
 {
-    if (state() || length < pos + size)
+    if (state() || size > length - pos)
         return 0;
     pos += size;
     return size;