lotuswordpro/source/filter/lwpdrawobj.cxx | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
New commits: commit 4e679d65674190fa5fa980d8fd6f0ffce71dd4af Author: Caolán McNamara <[email protected]> AuthorDate: Sun Mar 13 10:48:47 2022 +0000 Commit: Thorsten Behrens <[email protected]> CommitDate: Sat Mar 19 12:42:52 2022 +0100 ofz#45524 string is presumed to be at least length 1 Change-Id: If8a86e399109b414cf53f6e2bffdd3c7c6faa490 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131468 Tested-by: Jenkins Reviewed-by: Michael Stahl <[email protected]> (cherry picked from commit eca150aeb9254a3c04d15be5a6278c2c65bf3fb0) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131622 Tested-by: Thorsten Behrens <[email protected]> Reviewed-by: Thorsten Behrens <[email protected]> diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index fd5355ac3295..1489cf14cfdb 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -1255,7 +1255,11 @@ void LwpDrawTextArt::Read() - (m_aTextArtRec.aPath[1].n*3 + 1)*4; - if (!m_pStream->good() || m_aTextArtRec.nTextLen > m_pStream->remainingSize()) + if (!m_pStream->good()) + throw BadRead(); + if (m_aTextArtRec.nTextLen > m_pStream->remainingSize()) + throw BadRead(); + if (m_aTextArtRec.nTextLen < 1) throw BadRead(); m_aTextArtRec.pTextString = new sal_uInt8 [m_aTextArtRec.nTextLen];
