diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-01-09 11:30:00 +0000 |
|---|---|---|
| committer | Markus Mohrhard <markus.mohrhard@googlemail.com> | 2015-01-09 18:28:59 +0000 |
| commit | f35d61f021fc46b48ca1978ef6092e56a25c446a (patch) | |
| tree | 2acdb2a779246085abb61434299271198cfae4f0 | |
| parent | 9e283042477521416af2fc641c1843078d322480 (diff) | |
asan: global-buffer-overflow on ooo12093-1.doc
Change-Id: I5e29626fe2803d2751bdec9c6919662ea37cf64c
Reviewed-on: https://gerrit.libreoffice.org/13820
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Tested-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
| -rw-r--r-- | sw/source/filter/ww8/ww8par.cxx | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx index cb2a23fe5fcb..1185d90a66b0 100644 --- a/sw/source/filter/ww8/ww8par.cxx +++ b/sw/source/filter/ww8/ww8par.cxx @@ -5082,7 +5082,8 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss, const SwPosition &rPos) aInfo.ePos = FTNPOS_PAGE; aInfo.eNum = eNumA[pWDop->rncFtn]; - aInfo.aFmt.SetNumberingType( static_cast< sal_uInt16 >(eNumTA[pWDop->nfcFtnRef]) ); + sal_uInt16 nfcFtnRef = pWDop->nfcFtnRef & 0xF; + aInfo.aFmt.SetNumberingType( static_cast< sal_uInt16 >(eNumTA[nfcFtnRef]) ); if( pWDop->nFtn ) aInfo.nFtnOffset = pWDop->nFtn - 1; rDoc.SetFtnInfo( aInfo ); @@ -5091,8 +5092,8 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss, const SwPosition &rPos) { SwEndNoteInfo aInfo; aInfo = rDoc.GetEndNoteInfo(); // Same as for Ftn - - aInfo.aFmt.SetNumberingType( static_cast< sal_uInt16 >(eNumTA[pWDop->nfcEdnRef]) ); + sal_uInt16 nfcEdnRef = pWDop->nfcEdnRef & 0xF; + aInfo.aFmt.SetNumberingType( static_cast< sal_uInt16 >(eNumTA[nfcEdnRef]) ); if( pWDop->nEdn ) aInfo.nFtnOffset = pWDop->nEdn - 1; rDoc.SetEndNoteInfo( aInfo ); |