diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2016-09-13 09:20:25 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2016-09-13 09:21:33 +0100 |
| commit | 2546ca9dded58cfde5a4c35a3fde69ac3f27a767 (patch) | |
| tree | 5357603373376d153673bcc13c28d0f7a997744b /lotuswordpro | |
| parent | 5aaf4d89c5acfbdf1e85a760e3b3585f7d04e48a (diff) | |
coverity#1372879 Integer overflowed argument
Change-Id: I9e5115a00781d07c9c57e39854d6e1482bd02795
Diffstat (limited to 'lotuswordpro')
| -rw-r--r-- | lotuswordpro/source/filter/lwpgrfobj.cxx | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/lotuswordpro/source/filter/lwpgrfobj.cxx b/lotuswordpro/source/filter/lwpgrfobj.cxx index df843a9f8703..9d8903c8a103 100644 --- a/lotuswordpro/source/filter/lwpgrfobj.cxx +++ b/lotuswordpro/source/filter/lwpgrfobj.cxx @@ -680,17 +680,23 @@ void LwpGraphicObject::XFConvertEquation(XFContentContainer * pCont) // 18,12,0,0,0,0,0. // .TCIformat{2} //total head length = 45 + bool bOk = true; sal_uInt32 nBegin = 45; - sal_uInt32 nEnd = nDataLen -1; + sal_uInt32 nEnd = 0; + if (nDataLen >= 1) + nEnd = nDataLen - 1; + else + bOk = false; - if(pGrafData[nEnd] == '$' && pGrafData[nEnd-1]!= '\\') + if (bOk && pGrafData[nEnd] == '$' && nEnd > 0 && pGrafData[nEnd-1] != '\\') { //equation body is contained by '$'; nBegin++; nEnd--; } - if(nEnd >= nBegin) + bOk &= nEnd >= nBegin; + if (bOk) { sal_uInt8* pEquData = new sal_uInt8[nEnd - nBegin + 1]; for(sal_uInt32 nIndex = 0; nIndex < nEnd - nBegin +1 ; nIndex++) |