From: Caolán McNamara <caolanm@redhat.com>
Date: Sat, 27 Jan 2018 19:38:12 +0000 (+0000)
Subject: ofz#5747 short->sal_Int32 like in StgDataStrm
X-Git-Tag: archive/raspbian/1%5.2.7-1+rpi1+deb9u5^2~5
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=87b505ed97b17c2b8de572453f1ba292b50e01c4;p=libreoffice.git

ofz#5747 short->sal_Int32 like in StgDataStrm

Change-Id: I254c00b1142d7187beabe5d18532efec036de494
Reviewed-on: https://gerrit.libreoffice.org/48751
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

Gbp-Pq: Name CVE-2018-10119.diff
---

diff --git a/sot/source/sdstor/stgstrms.cxx b/sot/source/sdstor/stgstrms.cxx
index 4f749486c1c..dc07b7647b1 100644
--- a/sot/source/sdstor/stgstrms.cxx
+++ b/sot/source/sdstor/stgstrms.cxx
@@ -1047,7 +1047,7 @@ sal_Int32 StgSmallStrm::Read( void* pBuf, sal_Int32 n )
     // small stream is likely to be < 64 KBytes.
     if( ( m_nPos + n ) > m_nSize )
         n = m_nSize - m_nPos;
-    short nDone = 0;
+    sal_Int32 nDone = 0;
     while( n )
     {
         short nBytes = m_nPageSize - m_nOffset;
@@ -1059,7 +1059,7 @@ sal_Int32 StgSmallStrm::Read( void* pBuf, sal_Int32 n )
                 break;
             // all reading through the stream
             short nRes = (short) m_pData->Read( static_cast<sal_uInt8*>(pBuf) + nDone, nBytes );
-            nDone = nDone + nRes;
+            nDone += nRes;
             m_nPos += nRes;
             n -= nRes;
             m_nOffset = m_nOffset + nRes;
@@ -1078,7 +1078,7 @@ sal_Int32 StgSmallStrm::Write( const void* pBuf, sal_Int32 n )
 {
     // you can safely assume that reads are not huge, since the
     // small stream is likely to be < 64 KBytes.
-    short nDone = 0;
+    sal_Int32 nDone = 0;
     if( ( m_nPos + n ) > m_nSize )
     {
         sal_Int32 nOld = m_nPos;
@@ -1102,7 +1102,7 @@ sal_Int32 StgSmallStrm::Write( const void* pBuf, sal_Int32 n )
             if( !m_pData->Pos2Page( nDataPos ) )
                 break;
             short nRes = (short) m_pData->Write( static_cast<sal_uInt8 const *>(pBuf) + nDone, nBytes );
-            nDone = nDone + nRes;
+            nDone += nRes;
             m_nPos += nRes;
             n -= nRes;
             m_nOffset = m_nOffset + nRes;