[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/filter/svm/SvmReader.cxx |    8 ++++----
 vcl/source/filter/svm/SvmWriter.cxx |    2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

New commits:
commit 034e8a14f6b6c12b870a71cb808fcfdc41221714
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Aug 15 19:37:47 2022 +0100
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Tue Aug 16 09:49:35 2022 +0200

    ofz: Null-dereference-WRITE
    
    took oss-fuzz about a picosecond to find a crasher, lets just use
    sal_uInt32 here
    
    Change-Id: I582377bc30de1c46dce9d3cd659a80237848ed73
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138325
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/filter/svm/SvmReader.cxx 
b/vcl/source/filter/svm/SvmReader.cxx
index a7b990c3ddba..05696cc1e840 100644
--- a/vcl/source/filter/svm/SvmReader.cxx
+++ b/vcl/source/filter/svm/SvmReader.cxx
@@ -709,9 +709,9 @@ rtl::Reference<MetaAction> 
SvmReader::TextArrayHandler(const ImplMetaReadData* p
 
     if (aCompat.GetVersion() >= 3) // Version 3
     {
-        sal_Int32 nKashidaAryLen(0);
-        mrStream.ReadInt32(nKashidaAryLen);
-        nTmpLen = std::min(nKashidaAryLen, sal_Int32(aArray.size()));
+        sal_uInt32 nKashidaAryLen(0);
+        mrStream.ReadUInt32(nKashidaAryLen);
+        nTmpLen = std::min(nKashidaAryLen, 
static_cast<sal_uInt32>(aArray.size()));
         if (nTmpLen)
         {
             // aKashidaArray, if not empty, must be the same size as aArray
@@ -719,7 +719,7 @@ rtl::Reference<MetaAction> 
SvmReader::TextArrayHandler(const ImplMetaReadData* p
 
             // [-loplugin:fakebool] false positive:
             sal_Bool val(sal_False);
-            for (sal_Int32 i = 0; i < nTmpLen; i++)
+            for (sal_uInt32 i = 0; i < nTmpLen; i++)
             {
                 mrStream.ReadUChar(val);
                 aKashidaArray[i] = val;
diff --git a/vcl/source/filter/svm/SvmWriter.cxx 
b/vcl/source/filter/svm/SvmWriter.cxx
index 6dec8279c151..e79df6a756bd 100644
--- a/vcl/source/filter/svm/SvmWriter.cxx
+++ b/vcl/source/filter/svm/SvmWriter.cxx
@@ -1003,7 +1003,7 @@ void SvmWriter::TextArrayHandler(const 
MetaTextArrayAction* pAction, const ImplM
 
     // Version 3
     const auto& rKashidaArray = pAction->GetKashidaArray();
-    mrStream.WriteInt32(sal_Int32(rKashidaArray.size()));
+    mrStream.WriteUInt32(rKashidaArray.size());
     for (const auto& val : rKashidaArray)
         mrStream.WriteUChar(val);
 }