From 151a2ef72e12e87ac1bbdc2b8848454b8bc5e0f9 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Fri, 26 Mar 2021 09:26:10 +0000 Subject: ofz#32499 overflowing pos Change-Id: I164537acbb4d4bcf7dee51a029ffb518a3687fda Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113121 Tested-by: Jenkins Reviewed-by: Andras Timar --- hwpfilter/source/hiodev.cxx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'hwpfilter') diff --git a/hwpfilter/source/hiodev.cxx b/hwpfilter/source/hiodev.cxx index 56d4719e4302..a9bd14b57b11 100644 --- a/hwpfilter/source/hiodev.cxx +++ b/hwpfilter/source/hiodev.cxx @@ -337,7 +337,7 @@ size_t HMemIODev::readBlock(void *p, size_t size) { if (state()) return 0; - if (length < pos + size) + if (size > length - pos) size = length - pos; memcpy(p, ptr + pos, size); pos += size; @@ -346,7 +346,7 @@ size_t HMemIODev::readBlock(void *p, size_t size) size_t HMemIODev::skipBlock(size_t size) { - if (state() || length < pos + size) + if (state() || size > length - pos) return 0; pos += size; return size; -- cgit v1.2.3