[Libreoffice-commits] core.git: Branch 'libreoffice-7-2' - connectivity/source

[Caolán McNamara (via logerrit)]

 connectivity/source/drivers/dbase/DTable.cxx |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

New commits:
commit d0e177b7019af7f023dbf8c68b74233fea7d3bd8
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sun Sep 26 14:05:37 2021 +0100
Commit:     Michael Stahl <michael.stahl at allotropia.de>
CommitDate: Mon Sep 27 12:16:55 2021 +0200

    ofz#39304 short timestamp record
    
    Change-Id: I8f783473dd5d4679846c7c866cd1853ef7d919fc
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/122633
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.stahl at allotropia.de>

diff --git a/connectivity/source/drivers/dbase/DTable.cxx b/connectivity/source/drivers/dbase/DTable.cxx
index b6b1e7a7c3d1..c9c2991589db 100644
--- a/connectivity/source/drivers/dbase/DTable.cxx
+++ b/connectivity/source/drivers/dbase/DTable.cxx
@@ -795,10 +795,8 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool
     for (std::size_t i = 1; aIter != aEnd && nByteOffset <= m_nBufferSize && i < nCount;++aIter, i++)
     {
         // Lengths depending on data type:
-        sal_Int32 nLen = 0;
-        sal_Int32 nType = 0;
-        nLen    = m_aPrecisions[i-1];
-        nType   = m_aTypes[i-1];
+        sal_Int32 nLen = m_aPrecisions[i-1];
+        sal_Int32 nType = m_aTypes[i-1];
 
         switch(nType)
         {
@@ -857,8 +855,13 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool
         else if ( DataType::TIMESTAMP == nType )
         {
             sal_Int32 nDate = 0,nTime = 0;
+            if (o3tl::make_unsigned(nLen) < 8)
+            {
+                SAL_WARN("connectivity.drivers", "short TIMESTAMP");
+                return false;
+            }
             memcpy(&nDate, pData, 4);
-            memcpy(&nTime, pData+ 4, 4);
+            memcpy(&nTime, pData + 4, 4);
             if ( !nDate && !nTime )
             {
                 (*_rRow)[i]->setNull();