commit 34a7a7ff426dac55d62fc357cebbc0b22cd65c06
author Caolán McNamara <caolanm@redhat.com> Mon Aug 28 10:53:42 2017 +0100
committer Caolán McNamara <caolanm@redhat.com> Tue Sep 26 21:25:07 2017 +0200
tree a98eec6d128fac30a75c55acb4e6358de4e4865a
parent 2cd576c3bbcbabda4b6fa1758ae35cdcfb4bb1c8

ofz#3121 check bounds better

Change-Id: Ib1eacda7e4cdf1d0238532f4e38059a9c30556ac
Reviewed-on: https://gerrit.libreoffice.org/41626
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

filter/source/graphicfilter/icgm/class4.cxx

diff --git a/filter/source/graphicfilter/icgm/class4.cxx b/filter/source/graphicfilter/icgm/class4.cxx
index 68352bb..c505b39 100644
--- a/filter/source/graphicfilter/icgm/class4.cxx
+++ b/filter/source/graphicfilter/icgm/class4.cxx
@@ -186,7 +186,7 @@ void CGM::ImplDoClass4()
                sal_uInt32 nType = ImplGetUI16();
                sal_uInt32 nSize = ImplGetUI( 1 );

                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
                    throw css::uno::Exception("attempt to read past end of input", nullptr);

                mpSource[mnParaSize + nSize] = 0;
@@ -224,7 +224,7 @@ void CGM::ImplDoClass4()
                sal_uInt32 nType = ImplGetUI16();
                sal_uInt32 nSize = ImplGetUI(1);

                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
                    throw css::uno::Exception("attempt to read past end of input", nullptr);

                mpSource[ mnParaSize + nSize ] = 0;
@@ -242,7 +242,7 @@ void CGM::ImplDoClass4()
                (void)ImplGetUI16(); // nType
                sal_uInt32 nSize = ImplGetUI( 1 );

                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
                    throw css::uno::Exception("attempt to read past end of input", nullptr);

                mpSource[ mnParaSize + nSize ] = 0;