[Libreoffice-commits] core.git: Branch 'libreoffice-7-1' - connectivity/source

[Caolán McNamara (via logerrit)]

 connectivity/source/drivers/dbase/DTable.cxx |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

New commits:
commit f48e865653650a8f8215d929c31ff3d71ce940b3
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Sep 26 14:05:37 2021 +0100
Commit:     Michael Stahl <michael.st...@allotropia.de>
CommitDate: Mon Sep 27 12:16:36 2021 +0200

    ofz#39304 short timestamp record
    
    Change-Id: I8f783473dd5d4679846c7c866cd1853ef7d919fc
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/122634
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>

diff --git a/connectivity/source/drivers/dbase/DTable.cxx 
b/connectivity/source/drivers/dbase/DTable.cxx
index f16d2f1ee3eb..3740aaae8d19 100644
--- a/connectivity/source/drivers/dbase/DTable.cxx
+++ b/connectivity/source/drivers/dbase/DTable.cxx
@@ -771,10 +771,8 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const 
OSQLColumns & _rCols, bool
     for (std::size_t i = 1; aIter != aEnd && nByteOffset <= m_nBufferSize && i 
< nCount;++aIter, i++)
     {
         // Lengths depending on data type:
-        sal_Int32 nLen = 0;
-        sal_Int32 nType = 0;
-        nLen    = m_aPrecisions[i-1];
-        nType   = m_aTypes[i-1];
+        sal_Int32 nLen = m_aPrecisions[i-1];
+        sal_Int32 nType = m_aTypes[i-1];
 
         switch(nType)
         {
@@ -833,8 +831,13 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const 
OSQLColumns & _rCols, bool
         else if ( DataType::TIMESTAMP == nType )
         {
             sal_Int32 nDate = 0,nTime = 0;
+            if (o3tl::make_unsigned(nLen) < 8)
+            {
+                SAL_WARN("connectivity.drivers", "short TIMESTAMP");
+                return false;
+            }
             memcpy(&nDate, pData, 4);
-            memcpy(&nTime, pData+ 4, 4);
+            memcpy(&nTime, pData + 4, 4);
             if ( !nDate && !nTime )
             {
                 (*_rRow)[i]->setNull();