From 685956b45355324f7fef1c9bfc514a4dcf58b35b Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Mon, 7 Mar 2022 09:42:08 +0000
Subject: ofz#45314 limit to valid day/month indexes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: Ibf53fa1a0c1db3046a25367fb79da3b90f7cd924
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131098
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
---
 hwpfilter/source/hbox.cxx | 32 +++++++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 7 deletions(-)

diff --git a/hwpfilter/source/hbox.cxx b/hwpfilter/source/hbox.cxx
index c17f3f6f9742..ed477155f7b9 100644
--- a/hwpfilter/source/hbox.cxx
+++ b/hwpfilter/source/hbox.cxx
@@ -173,13 +173,20 @@ hchar_string DateCode::GetString()
             num = date[MONTH];
             break;
         case '@':
-            memcpy(cbuf, eng_mon + (date[MONTH] - 1) * 3, 3);
+        {
+            static_assert((std::size(eng_mon) - 1) / 3 == 12);
+            size_t nIndex = (date[MONTH] - 1) % 12;
+            memcpy(cbuf, eng_mon + nIndex * 3, 3);
             cbuf[3] = '.';
             cbuf[4] = 0;
-                break;
+            break;
+        }
         case '*':
-            strncat(cbuf, en_mon[date[MONTH] - 1], sizeof(cbuf) - strlen(cbuf) - 1);
+        {
+            size_t nIndex = (date[MONTH] - 1) % std::size(en_mon);
+            strncat(cbuf, en_mon[nIndex], sizeof(cbuf) - strlen(cbuf) - 1);
             break;
+        }
         case '3':                             /* 'D' is day of korean */
             num = date[DAY];
             break;
@@ -212,16 +219,26 @@ hchar_string DateCode::GetString()
             num = date[MIN];
             break;
         case '6':
-            ret.push_back(kor_week[date[WEEK]]);
+        {
+            size_t nIndex = date[WEEK] % std::size(kor_week);
+            ret.push_back(kor_week[nIndex]);
             break;
+        }
         case '^':
-            memcpy(cbuf, eng_week + date[WEEK] * 3, 3);
+        {
+            static_assert((std::size(eng_week) - 1) / 3 == 7);
+            size_t nIndex = date[WEEK] % 7;
+            memcpy(cbuf, eng_week + nIndex * 3, 3);
             cbuf[3] = '.';
             cbuf[4] = 0;
             break;
+        }
         case '_':
-            strncat(cbuf, en_week[date[WEEK]], sizeof(cbuf) - strlen(cbuf) - 1);
+        {
+            size_t nIndex = date[WEEK] % std::size(en_week);
+            strncat(cbuf, en_week[nIndex], sizeof(cbuf) - strlen(cbuf) - 1);
             break;
+        }
         case '7':
             ret.push_back(0xB5A1);
             ret.push_back(is_pm ? 0xD281 : 0xB8E5);
@@ -257,7 +274,8 @@ hchar_string DateCode::GetString()
             fmt++;
             if (*fmt == '6')
             {
-                ret.push_back(china_week[date[WEEK]]);
+                size_t nIndex = date[WEEK] % std::size(china_week);
+                ret.push_back(china_week[nIndex]);
                 break;
             }
             break;
-- 
cgit