diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-04-13 13:01:35 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-04-23 21:38:42 +0200 |
| commit | db8608fdcb8d6ed2915fea54631127ef634329c4 (patch) | |
| tree | 12b8ee5178a2bde04b8942bb897b83b33047c07c | |
| parent | e90524f03222432f22d80833c2a16f497a300191 (diff) | |
ofz: header has to be at least 1 pair long
(cherry picked from commit e72f3ce68e18ac604469ce5e856341a469af27ff)
Reviewed-on: https://gerrit.libreoffice.org/36520
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit ed8d18338f705fe249c88f1e735d1b45a408b2f7)
(cherry picked from commit 66b9d274ad0ed128795642dd7c50e41b671dfb40)
Change-Id: I5725048519a2b68265e90d12b1e4bcb506c56fc2
| -rw-r--r-- | sw/source/filter/ww8/ww8graf.cxx | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/sw/source/filter/ww8/ww8graf.cxx b/sw/source/filter/ww8/ww8graf.cxx index 6a0c2bba0704..5232873474a0 100644 --- a/sw/source/filter/ww8/ww8graf.cxx +++ b/sw/source/filter/ww8/ww8graf.cxx @@ -1254,12 +1254,20 @@ SdrObject* SwWW8ImplReader::ReadCaptionBox(WW8_DPHEAD* pHd, SfxAllItemSet &rSet) return 0; sal_uInt16 nCount = SVBT16ToShort( aCallB.dpPolyLine.aBits1 ) >> 1 & 0x7fff; + if (nCount < 1) + { + SAL_WARN("sw.ww8", "Short CaptionBox header"); + return nullptr; + } + boost::scoped_array<SVBT16> xP(new SVBT16[nCount * 2]); bool bCouldRead = checkRead(*m_pStrm, xP.get(), nCount * 4); // Punkte einlesen - OSL_ENSURE(bCouldRead, "Short CaptionBox header"); if (!bCouldRead) + { + SAL_WARN("sw.ww8", "Short CaptionBox header"); return 0; + } sal_uInt8 nTyp = (sal_uInt8)nCount - 1; if( nTyp == 1 && SVBT16ToShort( xP[0] ) == SVBT16ToShort( xP[2] ) ) |