[Libreoffice-commits] core.git: lotuswordpro/source

[Caolán McNamara (via logerrit)]

 lotuswordpro/source/filter/lwpsilverbullet.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit f37ef60c19d1608f0b597d37d025e401d6c99171
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Sep 5 15:15:42 2021 +0100
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Sun Sep 5 18:25:30 2021 +0200

    cid#1490901 silence Out-of-bounds read
    
    Change-Id: I9a2c1fe10fc696d5392cd6c95cff11124b5fdb01
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/121696
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/lotuswordpro/source/filter/lwpsilverbullet.cxx 
b/lotuswordpro/source/filter/lwpsilverbullet.cxx
index e2fa4112d243..629b5affcfb5 100644
--- a/lotuswordpro/source/filter/lwpsilverbullet.cxx
+++ b/lotuswordpro/source/filter/lwpsilverbullet.cxx
@@ -98,7 +98,8 @@ void LwpSilverBullet::Read()
     for (sal_uInt16 nC = 0; nC < nNumPos; nC++)
         m_pResetPositionFlags[nC] = m_pObjStrm->QuickReaduInt8();
 
-    std::fill(m_pResetPositionFlags + nNumPos, m_pResetPositionFlags + 
SAL_N_ELEMENTS(m_pResetPositionFlags), 0);
+    if (nNumPos < SAL_N_ELEMENTS(m_pResetPositionFlags))
+        std::fill(m_pResetPositionFlags + nNumPos, m_pResetPositionFlags + 
SAL_N_ELEMENTS(m_pResetPositionFlags), 0);
 
     m_nUseCount = m_pObjStrm->QuickReaduInt32();