diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2022-03-13 10:48:47 +0000 |
|---|---|---|
| committer | Michael Stahl <michael.stahl@allotropia.de> | 2022-03-18 15:19:18 +0100 |
| commit | 72090be467eda13587964c25a0c125572f440a1e (patch) | |
| tree | 335be4a916fc3d0606c9e0b8937bb9de4ecd1bf5 | |
| parent | 02e0899b58f54f71f6b0c364f7ff30d1a5bd4a0f (diff) | |
ofz#45524 string is presumed to be at least length 1
Change-Id: If8a86e399109b414cf53f6e2bffdd3c7c6faa490
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131468
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit eca150aeb9254a3c04d15be5a6278c2c65bf3fb0)
| -rw-r--r-- | lotuswordpro/source/filter/lwpdrawobj.cxx | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index 742e38f82c24..d1e496481c3d 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -1255,7 +1255,11 @@ void LwpDrawTextArt::Read() - (m_aTextArtRec.aPath[1].n*3 + 1)*4; - if (!m_pStream->good() || m_aTextArtRec.nTextLen > m_pStream->remainingSize()) + if (!m_pStream->good()) + throw BadRead(); + if (m_aTextArtRec.nTextLen > m_pStream->remainingSize()) + throw BadRead(); + if (m_aTextArtRec.nTextLen < 1) throw BadRead(); m_aTextArtRec.pTextString = new sal_uInt8 [m_aTextArtRec.nTextLen]; |