lotuswordpro/source/filter/lwpdrawobj.cxx | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
New commits:
commit eca150aeb9254a3c04d15be5a6278c2c65bf3fb0
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Mar 13 10:48:47 2022 +0000
Commit: Michael Stahl <michael.st...@allotropia.de>
CommitDate: Mon Mar 14 12:28:35 2022 +0100
ofz#45524 string is presumed to be at least length 1
Change-Id: If8a86e399109b414cf53f6e2bffdd3c7c6faa490
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131468
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx
b/lotuswordpro/source/filter/lwpdrawobj.cxx
index f1abe2c438f3..a03b6deb8827 100644
--- a/lotuswordpro/source/filter/lwpdrawobj.cxx
+++ b/lotuswordpro/source/filter/lwpdrawobj.cxx
@@ -1249,7 +1249,11 @@ void LwpDrawTextArt::Read()
-
(m_aTextArtRec.aPath[1].n*3 + 1)*4;
- if (!m_pStream->good() || m_aTextArtRec.nTextLen >
m_pStream->remainingSize())
+ if (!m_pStream->good())
+ throw BadRead();
+ if (m_aTextArtRec.nTextLen > m_pStream->remainingSize())
+ throw BadRead();
+ if (m_aTextArtRec.nTextLen < 1)
throw BadRead();
m_aTextArtRec.pTextString = new sal_uInt8 [m_aTextArtRec.nTextLen];
