[Libreoffice-commits] core.git: Branch 'libreoffice-7-3' - lotuswordpro/source

[Caolán McNamara (via logerrit)]

 lotuswordpro/source/filter/lwpdrawobj.cxx |    3 +++
 1 file changed, 3 insertions(+)

New commits:
commit f4209871f1054ac7dcc5d4b90ce8fc2087288c2b
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Wed Jan 26 11:57:13 2022 +0000
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Thu Jan 27 11:49:51 2022 +0100

    ofz#44080 throw exception on a negative length
    
    Change-Id: I3e2286cea69908fae3a2dd177d10fca2b7f0c877
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128955
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx 
b/lotuswordpro/source/filter/lwpdrawobj.cxx
index dbd906a5c0bd..79707ebdad6b 100644
--- a/lotuswordpro/source/filter/lwpdrawobj.cxx
+++ b/lotuswordpro/source/filter/lwpdrawobj.cxx
@@ -1094,6 +1094,9 @@ XFFrame* LwpDrawTextBox::CreateDrawObj(const OUString& 
rStyleName )
         aEncoding = LwpCharSetMgr::GetTextCharEncoding();
     }
 
+    if (TextLength < 2)
+        throw BadRead();
+
     XFParagraph* pXFPara = new XFParagraph();
     pXFPara->Add(OUString(reinterpret_cast<char*>(m_aTextRec.pTextString), 
(TextLength-2), aEncoding));
     pXFPara->SetStyleName(rStyleName);