diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2022-01-09 16:16:39 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2022-01-09 22:26:38 +0100 |
| commit | e28f4b6bccafb2b9f3c44dfabf36d1b822d85f84 (patch) | |
| tree | 78f8bb4e5041f1e838489b9d92746856c03a748d /lotuswordpro/source | |
| parent | ofz#43446 Undefined-shift (diff) | |
| download | core-e28f4b6bccafb2b9f3c44dfabf36d1b822d85f84.tar.gz core-e28f4b6bccafb2b9f3c44dfabf36d1b822d85f84.zip | |
ofz#43458 avoid OOM
Change-Id: Id0e1e985c446c147a219ba2f5157a41deae656a4
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128193
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'lotuswordpro/source')
| -rw-r--r-- | lotuswordpro/source/filter/lwpdrawobj.cxx | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index 2ea201082cce..4811c8b8d9cc 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -1047,6 +1047,8 @@ void LwpDrawTextBox::Read() // the 71 is the fixed length before text content in textbox record sal_Int16 TextLength = m_aObjHeader.nRecLen - 71; + if (TextLength < 0) + throw BadRead(); m_aTextRec.pTextString = new sal_uInt8 [TextLength]; m_pStream->ReadBytes(m_aTextRec.pTextString, TextLength); |