lotuswordpro/source/filter/lwpgrfobj.cxx | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
New commits: commit 2546ca9dded58cfde5a4c35a3fde69ac3f27a767 Author: Caolán McNamara <[email protected]> Date: Tue Sep 13 09:20:25 2016 +0100 coverity#1372879 Integer overflowed argument Change-Id: I9e5115a00781d07c9c57e39854d6e1482bd02795 diff --git a/lotuswordpro/source/filter/lwpgrfobj.cxx b/lotuswordpro/source/filter/lwpgrfobj.cxx index df843a9..9d8903c 100644 --- a/lotuswordpro/source/filter/lwpgrfobj.cxx +++ b/lotuswordpro/source/filter/lwpgrfobj.cxx @@ -680,17 +680,23 @@ void LwpGraphicObject::XFConvertEquation(XFContentContainer * pCont) // 18,12,0,0,0,0,0. // .TCIformat{2} //total head length = 45 + bool bOk = true; sal_uInt32 nBegin = 45; - sal_uInt32 nEnd = nDataLen -1; + sal_uInt32 nEnd = 0; + if (nDataLen >= 1) + nEnd = nDataLen - 1; + else + bOk = false; - if(pGrafData[nEnd] == '$' && pGrafData[nEnd-1]!= '\\') + if (bOk && pGrafData[nEnd] == '$' && nEnd > 0 && pGrafData[nEnd-1] != '\\') { //equation body is contained by '$'; nBegin++; nEnd--; } - if(nEnd >= nBegin) + bOk &= nEnd >= nBegin; + if (bOk) { sal_uInt8* pEquData = new sal_uInt8[nEnd - nBegin + 1]; for(sal_uInt32 nIndex = 0; nIndex < nEnd - nBegin +1 ; nIndex++)
_______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
