[Libreoffice-commits] core.git: sw/source

[Caolán McNamara (via logerrit)]

 sw/source/filter/ww8/ww8par.cxx |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

New commits:
commit 152752ad8552024209ca36b0eb13fea2893c5f96
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Jan 30 15:04:53 2022 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Sun Jan 30 20:17:54 2022 +0100

    ofz#44207 Integer-overflow
    
    Change-Id: Ia3cace5df71ec9dbf17d06f3c21b65a87025bfd5
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/129172
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 97b0a4752d17..f3b5b6e4e958 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -3020,7 +3020,15 @@ bool SwWW8ImplReader::ReadPlainChars(WW8_CP& rPos, 
sal_Int32 nEnd, sal_Int32 nCp
     if (nRequestedStrLen <= 0)
         return true;
 
-    sal_Int32 nRequestedPos = m_xSBase->WW8Cp2Fc(nCpOfs+rPos, &m_bIsUnicode);
+    WW8_CP nCp;
+    const bool bFail = o3tl::checked_add(nCpOfs, rPos, nCp);
+    if (bFail)
+    {
+        rPos+=nRequestedStrLen;
+        return true;
+    }
+
+    sal_Int32 nRequestedPos = m_xSBase->WW8Cp2Fc(nCp, &m_bIsUnicode);
     bool bValidPos = checkSeek(*m_pStrm, nRequestedPos);
     OSL_ENSURE(bValidPos, "Document claimed to have more text than available");
     if (!bValidPos)