diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2019-11-01 17:29:56 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2019-11-01 20:25:44 +0100 |
| commit | dc144f115eb2ef0945837d66fd5ebb1e5a1fa2eb (patch) | |
| tree | d08ab42a8fe74c81e767c1efed9a513de89e554e /filter | |
| parent | b8c0065abff3d7834004a573f07192e7501feec0 (diff) | |
ofz#18646 ensure we are inside valid range
Change-Id: Ide4d4bfad5b365a42790454cca709d175054c933
Reviewed-on: https://gerrit.libreoffice.org/81908
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/icgm/cgm.cxx | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/filter/source/graphicfilter/icgm/cgm.cxx b/filter/source/graphicfilter/icgm/cgm.cxx index 8122d399eaa6..32f9fca0257b 100644 --- a/filter/source/graphicfilter/icgm/cgm.cxx +++ b/filter/source/graphicfilter/icgm/cgm.cxx @@ -97,7 +97,7 @@ sal_uInt8 CGM::ImplGetByte( sal_uInt32 nSource, sal_uInt32 nPrecision ) sal_Int32 CGM::ImplGetI( sal_uInt32 nPrecision ) { sal_uInt8* pSource = mpSource + mnParaSize; - if (static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision) + if (pSource > mpEndValidSource || static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision) throw css::uno::Exception("attempt to read past end of input", nullptr); mnParaSize += nPrecision; switch( nPrecision ) @@ -129,7 +129,7 @@ sal_Int32 CGM::ImplGetI( sal_uInt32 nPrecision ) sal_uInt32 CGM::ImplGetUI( sal_uInt32 nPrecision ) { sal_uInt8* pSource = mpSource + mnParaSize; - if (static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision) + if (pSource > mpEndValidSource || static_cast<sal_uIntPtr>(mpEndValidSource - pSource) < nPrecision) throw css::uno::Exception("attempt to read past end of input", nullptr); mnParaSize += nPrecision; switch( nPrecision ) |