[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/filter/svm/SvmReader.cxx |   15 +++++++++++++++
 1 file changed, 15 insertions(+)

New commits:
commit cda53485ec0f2c666c86c0ac99e7af4b0f2b352f
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Apr 25 21:11:40 2022 +0100
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Tue Apr 26 11:49:19 2022 +0200

    ofz#46906 Integer-overflow
    
    Change-Id: Ic4c6b34b8fb2ddfbb606871f48e2b504fd24336d
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133421
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/filter/svm/SvmReader.cxx 
b/vcl/source/filter/svm/SvmReader.cxx
index fe05c3439719..bd69e7ece142 100644
--- a/vcl/source/filter/svm/SvmReader.cxx
+++ b/vcl/source/filter/svm/SvmReader.cxx
@@ -22,6 +22,7 @@
 #include <tools/stream.hxx>
 #include <tools/vcompat.hxx>
 
+#include <unotools/configmgr.hxx>
 #include <vcl/filter/SvmReader.hxx>
 #include <vcl/TypeSerializer.hxx>
 #include <vcl/dibtools.hxx>
@@ -705,7 +706,21 @@ rtl::Reference<MetaAction> 
SvmReader::TextArrayHandler(const ImplMetaReadData* p
     }
 
     if (!aArray.empty())
+    {
+        static const bool bFuzzing = utl::ConfigManager::IsFuzzing();
+        if (bFuzzing)
+        {
+            for (size_t i = 0, nLen = aArray.size(); i < nLen; ++i)
+            {
+                if (aArray[i] < -4096 || aArray[i] > 4096)
+                {
+                    SAL_WARN("vcl.gdi", "suspicious dx of: " << aArray[i]);
+                    aArray[i] = 0;
+                }
+            }
+        }
         pAction->SetDXArray(std::move(aArray));
+    }
     return pAction;
 }