mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ofz#3780 Integer-overflow

Browse Source 
Change-Id: Ia51ec4069249c26ea1ee469df42aa172f61587a9
Reviewed-on: https://gerrit.libreoffice.org/43814
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
This commit is contained in:
Caolán McNamara
2017-10-25 10:04:20 +01:00
parent dbe1ba3361
commit 562aba2b26
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
sw/source/filter/ww8/ww8scan.cxx
View File

@@ -1509,7 +1509,17 @@ WW8_FC WW8ScannerBase::WW8Cp2Fc(WW8_CP nCpPos, bool* pIsUnicode,
else
*pIsUnicode = m_pWw8Fib->m_fExtChar;
nRet += (nCpPos - nCpStart) * (*pIsUnicode ? 2 : 1);
WW8_CP nCpLen = nCpPos - nCpStart;
if (*pIsUnicode)
{
const bool bFail = o3tl::checked_multiply<WW8_CP>(nCpLen, 2, nCpLen);
if (bFail)
{
SAL_WARN("sw.ww8", "broken offset, ignoring");
return WW8_CP_MAX;
}
}
nRet += nCpLen;
return nRet;
}