filter/source/msfilter/dffpropset.cxx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
New commits: commit 3da533cabddb0e02bd2d57bfd2acfb452cee0e61 Author: Caolán McNamara <[email protected]> Date: Sat Oct 21 17:09:09 2017 +0100 check if seek succeeded Change-Id: Ic31392def4f5887d514c2ff9b8ecad0fd7190ffb Reviewed-on: https://gerrit.libreoffice.org/43662 Tested-by: Jenkins <[email protected]> Reviewed-by: Caolán McNamara <[email protected]> Tested-by: Caolán McNamara <[email protected]> diff --git a/filter/source/msfilter/dffpropset.cxx b/filter/source/msfilter/dffpropset.cxx index 6c66c0702470..58b9e6dd28a0 100644 --- a/filter/source/msfilter/dffpropset.cxx +++ b/filter/source/msfilter/dffpropset.cxx @@ -1168,11 +1168,11 @@ void DffPropSet::ReadPropSet( SvStream& rIn, bool bSetUninitializedOnly ) { // now check if the current content size is possible, or 6 bytes too small sal_uInt32 nOldPos = rIn.Tell(); - sal_Int16 nNumElem, nNumElemReserved, nSize; - rIn.Seek( nComplexDataFilePos ); - rIn. ReadInt16( nNumElem ).ReadInt16( nNumElemReserved ).ReadInt16( nSize ); - if ( nNumElemReserved >= nNumElem ) + sal_Int16 nNumElem(0), nNumElemReserved(0), nSize(0); + if (checkSeek(rIn, nComplexDataFilePos)) + rIn.ReadInt16(nNumElem).ReadInt16(nNumElemReserved).ReadInt16(nSize); + if (nNumElemReserved >= nNumElem) { // the size of these array elements is nowhere defined, // what if the size is negative ?
_______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
