filter/source/graphicfilter/icgm/cgm.cxx | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
New commits:
commit dc144f115eb2ef0945837d66fd5ebb1e5a1fa2eb
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Fri Nov 1 17:29:56 2019 +0000
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Fri Nov 1 20:25:44 2019 +0100
ofz#18646 ensure we are inside valid range
Change-Id: Ide4d4bfad5b365a42790454cca709d175054c933
Reviewed-on: https://gerrit.libreoffice.org/81908
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/filter/source/graphicfilter/icgm/cgm.cxx
b/filter/source/graphicfilter/icgm/cgm.cxx
index 8122d399eaa6..32f9fca0257b 100644
--- a/filter/source/graphicfilter/icgm/cgm.cxx
+++ b/filter/source/graphicfilter/icgm/cgm.cxx
@@ -97,7 +97,7 @@ sal_uInt8 CGM::ImplGetByte( sal_uInt32 nSource, sal_uInt32
nPrecision )
sal_Int32 CGM::ImplGetI( sal_uInt32 nPrecision )
{
sal_uInt8* pSource = mpSource + mnParaSize;
- if (static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision)
+ if (pSource > mpEndValidSource ||
static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision)
throw css::uno::Exception("attempt to read past end of input",
nullptr);
mnParaSize += nPrecision;
switch( nPrecision )
@@ -129,7 +129,7 @@ sal_Int32 CGM::ImplGetI( sal_uInt32 nPrecision )
sal_uInt32 CGM::ImplGetUI( sal_uInt32 nPrecision )
{
sal_uInt8* pSource = mpSource + mnParaSize;
- if (static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision)
+ if (pSource > mpEndValidSource ||
static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision)
throw css::uno::Exception("attempt to read past end of input",
nullptr);
mnParaSize += nPrecision;
switch( nPrecision )
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
