From 3d8222a5adc873e3ae40a1693896b75ebb3c88b8 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Wed, 26 Jan 2022 11:57:13 +0000
Subject: ofz#44080 throw exception on a negative length

Change-Id: I3e2286cea69908fae3a2dd177d10fca2b7f0c877
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128956
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit af8709defeb90464c8724d3fe5fb8cbbf6efc2b8)
---
 lotuswordpro/source/filter/lwpdrawobj.cxx | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'lotuswordpro')

diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx
index 4ffffb2fa536..a3fd862766d0 100644
--- a/lotuswordpro/source/filter/lwpdrawobj.cxx
+++ b/lotuswordpro/source/filter/lwpdrawobj.cxx
@@ -1090,6 +1090,9 @@ XFFrame* LwpDrawTextBox::CreateDrawObj(const OUString& rStyleName )
         aEncoding = LwpCharSetMgr::GetTextCharEncoding();
     }
 
+    if (TextLength < 2)
+        throw BadRead();
+
     XFParagraph* pXFPara = new XFParagraph();
     pXFPara->Add(OUString(reinterpret_cast<char*>(m_aTextRec.pTextString), (TextLength-2), aEncoding));
     pXFPara->SetStyleName(rStyleName);
-- 
cgit