SwXFlatParagraph: check some positions before blindly using them

Change-Id: Ic33b7a4b87120bd01b56737ded0411651306098d

1 files changed, 10 insertions, 0 deletions

diff --git a/sw/source/core/unocore/unoflatpara.cxx b/sw/source/core/unocore/unoflatpara.cxx
index d25d6fffbdac..fc7710e962ff 100644
--- a/sw/source/core/unocore/unoflatpara.cxx
+++ b/sw/source/core/unocore/unoflatpara.cxx
@@ -251,6 +251,11 @@ void SAL_CALL SwXFlatParagraph::changeText(::sal_Int32 nPos, ::sal_Int32 nLen, c
 
     SwTextNode *const pOldTextNode = GetTextNode();
 
+    if (nPos < 0 || pOldTextNode->Len() < nPos || nLen < 0 || static_cast<sal_uInt32>(pOldTextNode->Len()) < static_cast<sal_uInt32>(nPos) + nLen)
+    {
+        throw lang::IllegalArgumentException();
+    }
+
     SwPaM aPaM( *GetTextNode(), nPos, *GetTextNode(), nPos+nLen );
 
     UnoActionContext aAction( GetTextNode()->GetDoc() );
@@ -279,6 +284,11 @@ void SAL_CALL SwXFlatParagraph::changeAttributes(::sal_Int32 nPos, ::sal_Int32 n
     if (!GetTextNode())
         return;
 
+    if (nPos < 0 || GetTextNode()->Len() < nPos || nLen < 0 || static_cast<sal_uInt32>(GetTextNode()->Len()) < static_cast<sal_uInt32>(nPos) + nLen)
+    {
+        throw lang::IllegalArgumentException();
+    }
+
     SwPaM aPaM( *GetTextNode(), nPos, *GetTextNode(), nPos+nLen );
 
     UnoActionContext aAction( GetTextNode()->GetDoc() );