diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-07-22 13:51:19 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2015-08-03 19:50:51 +0200 |
| commit | 442d611db76752bef70ae2ff703cc687b5730ecb (patch) | |
| tree | fe84a3146cc83b14a1ae879bed408f8b48373d42 | |
| parent | 1f3ddbf45624f8d831d8716118a4b89cc6bd32d7 (diff) | |
xstUsrInitl contains max 9 chars
(cherry picked from commit cbea6a709f33babfb490ab1bd07cde8cc08114ac)
Change-Id: Ia40d037d7af6cd3a283aa12948e4c5565dcb2ae6
Reviewed-on: https://gerrit.libreoffice.org/17293
Reviewed-by: Michael Meeks <michael.meeks@collabora.com>
Tested-by: Michael Meeks <michael.meeks@collabora.com>
| -rw-r--r-- | sw/qa/core/data/ww8/pass/crash-1.doc | bin | 0 -> 10240 bytes | |||
| -rw-r--r-- | sw/source/filter/ww8/ww8par.cxx | 13 |
2 files changed, 8 insertions, 5 deletions
diff --git a/sw/qa/core/data/ww8/pass/crash-1.doc b/sw/qa/core/data/ww8/pass/crash-1.doc Binary files differnew file mode 100644 index 000000000000..9f6b25348c64 --- /dev/null +++ b/sw/qa/core/data/ww8/pass/crash-1.doc diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx index 9a6131cce5c2..7489ca5a2d3e 100644 --- a/sw/source/filter/ww8/ww8par.cxx +++ b/sw/source/filter/ww8/ww8par.cxx @@ -2172,15 +2172,18 @@ long SwWW8ImplReader::Read_And(WW8PLCFManResult* pRes) if (pA) sAuthor = *pA; else - sAuthor = OUString(pDescri->xstUsrInitl + 1, pDescri->xstUsrInitl[0], - RTL_TEXTENCODING_MS_1252); + { + const sal_uInt8 nLen = std::min<sal_uInt8>(pDescri->xstUsrInitl[0], + SAL_N_ELEMENTS(pDescri->xstUsrInitl)-1); + sAuthor = OUString(pDescri->xstUsrInitl + 1, nLen, RTL_TEXTENCODING_MS_1252); + } } else { - const WW8_ATRD* pDescri = (const WW8_ATRD*)pSD->GetData(); - + const WW8_ATRD* pDescri = static_cast<const WW8_ATRD*>(pSD->GetData()); { - const sal_uInt16 nLen = SVBT16ToShort(pDescri->xstUsrInitl[0]); + const sal_uInt16 nLen = std::min<sal_uInt16>(SVBT16ToShort(pDescri->xstUsrInitl[0]), + SAL_N_ELEMENTS(pDescri->xstUsrInitl)-1); OUStringBuffer aBuf; aBuf.setLength(nLen); for(sal_uInt16 nIdx = 1; nIdx <= nLen; ++nIdx) |