sw/source/filter/ww8/ww8scan.cxx | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
New commits: commit 6b61c3f7fdcdd8721bf51c39fdcce7e9851a6686 Author: Caolán McNamara <caol...@redhat.com> Date: Tue Oct 31 08:49:39 2017 +0000 ofz#3935 Integer-overflow Change-Id: I2f79eaf7887b48a6aab2041ac7949a62c4bce256 Reviewed-on: https://gerrit.libreoffice.org/44101 Reviewed-by: Caolán McNamara <caol...@redhat.com> Tested-by: Caolán McNamara <caol...@redhat.com> diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index 3f5d39c8f3c8..4afa6b66a32b 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -2235,11 +2235,17 @@ void WW8PLCF::GeneratePLCF(SvStream& rSt, sal_Int32 nPN, sal_Int32 ncpN) bool failure = false; nIMax = ncpN; - if ((nIMax < 1) || (nIMax > (WW8_CP_MAX - 4) / (4 + nStru)) || ((nPN + ncpN) > USHRT_MAX) || nPN < 0) + if ((nIMax < 1) || (nIMax > (WW8_CP_MAX - 4) / (4 + nStru)) || nPN < 0) failure = true; if (!failure) { + sal_Int32 nResult; + failure = o3tl::checked_add(nPN, ncpN, nResult) || nResult > USHRT_MAX; + } + + if (!failure) + { size_t nSiz = (4 + nStru) * nIMax + 4; size_t nElems = ( nSiz + 3 ) / 4; pPLCF_PosArray.reset( new sal_Int32[ nElems ] ); // Pointer to Pos-array
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits