[Libreoffice-commits] core.git: Branch 'libreoffice-7-2' - lotuswordpro/source

[Caolán McNamara (via logerrit)]

 lotuswordpro/source/filter/lwpdrawobj.cxx |    2 ++
 1 file changed, 2 insertions(+)

New commits:
commit 35be5565c8e054a343954ee545df65c29384ff27
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Jan 9 16:16:39 2022 +0000
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Tue Jan 11 11:15:42 2022 +0100

    ofz#43458 avoid OOM
    
    Change-Id: Id0e1e985c446c147a219ba2f5157a41deae656a4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128193
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit e28f4b6bccafb2b9f3c44dfabf36d1b822d85f84)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128236
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx 
b/lotuswordpro/source/filter/lwpdrawobj.cxx
index 547017a68555..89eaf1c0a255 100644
--- a/lotuswordpro/source/filter/lwpdrawobj.cxx
+++ b/lotuswordpro/source/filter/lwpdrawobj.cxx
@@ -1046,6 +1046,8 @@ void LwpDrawTextBox::Read()
 
     // the 71 is the fixed length before text content in textbox record
     sal_Int16 TextLength = m_aObjHeader.nRecLen - 71;
+    if (TextLength < 0)
+        throw BadRead();
     m_aTextRec.pTextString = new sal_uInt8 [TextLength];
 
     m_pStream->ReadBytes(m_aTextRec.pTextString, TextLength);