? unxlngx6.pro
Index: source/zipapi/ZipFile.cxx
===================================================================
RCS file: /cvs/xml/package/source/zipapi/ZipFile.cxx,v
retrieving revision 1.46
diff -u -r1.46 ZipFile.cxx
--- source/zipapi/ZipFile.cxx	3 Apr 2007 14:08:01 -0000	1.46
+++ source/zipapi/ZipFile.cxx	13 Aug 2007 09:11:59 -0000
@@ -789,13 +789,13 @@
 			aEntry.nOffset += nLocPos;
 			aEntry.nOffset *= -1;
 
-			if ( aEntry.nNameLen > ZIP_MAXNAMELEN )
+			if ( aEntry.nNameLen < 0 || aEntry.nNameLen > ZIP_MAXNAMELEN )
 				throw ZipException( OUString( RTL_CONSTASCII_USTRINGPARAM ( "name length exceeds ZIP_MAXNAMELEN bytes" ) ), Reference < XInterface > () );
 
-			if ( nCommentLen > ZIP_MAXNAMELEN )
+			if ( nCommentLen < 0 || nCommentLen > ZIP_MAXNAMELEN )
 				throw ZipException( OUString( RTL_CONSTASCII_USTRINGPARAM ( "comment length exceeds ZIP_MAXNAMELEN bytes" ) ), Reference < XInterface > () );
 
-			if ( aEntry.nExtraLen > ZIP_MAXEXTRA )
+			if ( aEntry.nExtraLen < 0 || aEntry.nExtraLen > ZIP_MAXEXTRA )
 				throw ZipException( OUString( RTL_CONSTASCII_USTRINGPARAM ( "extra header info exceeds ZIP_MAXEXTRA bytes") ), Reference < XInterface > () );
 
 			aEntry.sName = rtl::OUString::intern ( (sal_Char *) aMemGrabber.getCurrentPos(),