diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-04-04 12:31:04 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-04-23 21:36:16 +0200 |
| commit | 786cbde1e7ae741d9a5160ae8fe35fcc7d67b007 (patch) | |
| tree | 6c89aff59bd8eebd1aa8ff3fefbda99a7150aecc | |
| parent | 49b43bb28829169edeca4176a88599f3c3dbfd8f (diff) | |
ofz: guard against bogus sprm len
Change-Id: I9b4074e1024753549f468f427afbfdf9cd01b674
(cherry picked from commit d30fb62f4f1022ae6294e246974d0018596cf8ec)
ofz: guard harder against bogus sprm len
Change-Id: Ic82526e1454b24f094d3deee89647e88760bc44b
(cherry picked from commit 924624b40a97d6925f66374259c2c21707805fcd)
Reviewed-on: https://gerrit.libreoffice.org/36079
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit 75e7cc598fe9d61d9f6f3f96976b11e27627bc2f)
(cherry picked from commit fbe082a102b270342f2a9392e4e2590bd693ff14)
| -rw-r--r-- | sw/source/filter/ww8/ww8scan.cxx | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index 109a3c29b08d..4609d3ff84e3 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -4803,6 +4803,11 @@ void WW8PLCFMan::GetSprmStart( short nIdx, WW8PLCFManResult* pRes ) const { // Length of actual sprm pRes->nMemLen = maSprmParser.GetSprmSize(pRes->nSprmId, pRes->pMemPos); + if (pRes->nMemLen > p->nSprmsLen) + { + SAL_WARN("sw.ww8", "Short sprm, len " << pRes->nMemLen << " claimed, max possible is " << p->nSprmsLen); + pRes->nSprmId = 0; + } } } |