[Libreoffice-commits] core.git: Branch 'libreoffice-7-4' - hwpfilter/source

[Caolán McNamara (via logerrit)]

 hwpfilter/source/hbox.cxx |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit 9d846a1d77a1ba157c55589a6b2ccb6388eef35d
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Dec 19 21:19:40 2022 +0000
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Tue Dec 20 08:48:12 2022 +0000

    cid#1517796 Out-of-bounds read
    
    Change-Id: I930e3888cfa3363b9183619225f0d4cdca197cdd
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144548
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/hwpfilter/source/hbox.cxx b/hwpfilter/source/hbox.cxx
index c5a10fb36a7d..2354ad816120 100644
--- a/hwpfilter/source/hbox.cxx
+++ b/hwpfilter/source/hbox.cxx
@@ -615,7 +615,7 @@ OUString Outline::GetUnicode() const
                     char dest[80];
                     int l = 0;
                     unsigned int i = level;
-                    if( deco[i][0] ){
+                    if (i < std::size(deco) && deco[i][0]) {
                         buffer[l++] = deco[i][0];
                     }
 /* level starts from zero. ex) '1.1.1.' is the level 2.
@@ -693,7 +693,7 @@ OUString Outline::GetUnicode() const
                                 break;
                         }
                     }
-                    if( deco[i][1] ){
+                    if (i < std::size(deco) && deco[i][1]) {
                         buffer[l++] = deco[i][1];
                     }
                     buffer[l] = 0;