fdo#77308: SwFormTokensHelper avoid infinite loop on invalid input

In 4.1 this loops because the input is truncated to 64k length; try to
avoid looping when the input is invalid and the terminating ">" cannot
be found.

Change-Id: I9261d9350f84ab366b822addde725645a46be830

2 files changed, 20 insertions, 20 deletions

diff --git a/sw/inc/tox.hxx b/sw/inc/tox.hxx
index 859374fc29af..c626bda2d1b2 100644
--- a/sw/inc/tox.hxx
+++ b/sw/inc/tox.hxx
@@ -30,6 +30,7 @@
 #include <calbck.hxx>
 
 #include <vector>
+#include <boost/optional.hpp>
 
 namespace com { namespace sun { namespace star {
     namespace text { class XDocumentIndexMark; }
@@ -274,7 +275,7 @@ class SW_DLLPUBLIC SwFormTokensHelper
 
        @return the token
      */
-    SAL_DLLPRIVATE SwFormToken BuildToken( const OUString & sPattern,
+    SAL_DLLPRIVATE boost::optional<SwFormToken> BuildToken( const OUString & sPattern,
                                           sal_Int32 & nCurPatternPos ) const;
 
     /**
diff --git a/sw/source/core/tox/tox.cxx b/sw/source/core/tox/tox.cxx
index f0f0495589e8..03c981585a32 100644
--- a/sw/source/core/tox/tox.cxx
+++ b/sw/source/core/tox/tox.cxx
@@ -31,10 +31,14 @@
 #include <editeng/tstpitem.hxx>
 #include <SwStyleNameMapper.hxx>
 #include <hints.hxx>
-#include <algorithm>
 #include <functional>
 #include <switerator.hxx>
 
+#include <boost/optional.hpp>
+
+#include <algorithm>
+
+
 using namespace std;
 
 namespace
@@ -694,25 +698,29 @@ OUString SwFormToken::GetString() const
 SwFormTokensHelper::SwFormTokensHelper(const OUString & rPattern)
 {
     sal_Int32 nCurPatternPos = 0;
-    sal_Int32 nCurPatternLen = 0;
 
     while (nCurPatternPos < rPattern.getLength())
     {
-        // FIXME: nCurPatternLen added but set to 0?
-        nCurPatternPos = nCurPatternPos + nCurPatternLen;
-
-        SwFormToken aToken = BuildToken(rPattern, nCurPatternPos);
-        aTokens.push_back(aToken);
+        boost::optional<SwFormToken> const oToken(
+                BuildToken(rPattern, nCurPatternPos));
+        if (oToken)
+            aTokens.push_back(oToken.get());
     }
 }
 
-SwFormToken SwFormTokensHelper::BuildToken( const OUString & sPattern,
+boost::optional<SwFormToken>
+SwFormTokensHelper::BuildToken( const OUString & sPattern,
                                             sal_Int32 & nCurPatternPos ) const
 {
     OUString sToken( SearchNextToken(sPattern, nCurPatternPos) );
     nCurPatternPos += sToken.getLength();
     sal_Int32 nTokenLen = 0;
     FormTokenType eTokenType = GetTokenType(sToken, &nTokenLen);
+    if (TOKEN_END == eTokenType) // invalid input? skip it
+    {
+        nCurPatternPos = sPattern.getLength();
+        return boost::optional<SwFormToken>();
+    }
 
     // at this point sPattern contains the
     // character style name, the PoolId, tab stop position, tab stop alignment, chapter info format
@@ -786,17 +794,8 @@ SwFormToken SwFormTokensHelper::BuildToken( const OUString & sPattern,
 OUString SwFormTokensHelper::SearchNextToken( const OUString & sPattern,
                                               sal_Int32 nStt ) const
 {
-    //it's not so easy - it doesn't work if the text part contains a '>'
-
     sal_Int32 nEnd = sPattern.indexOf( '>', nStt );
-    if( nEnd<0 )
-    {
-        // FIXME: why is nEnd updated?
-        //        should "aResult = sPattern.copy( nStt, nEnd - nStt );"
-        //        or something like that be returned?
-        nEnd = sPattern.getLength();
-    }
-    else
+    if (nEnd >= 0)
     {
         // apparently the TOX_STYLE_DELIMITER act as a bracketing for
         // TOKEN_TEXT tokens so that the user can have '>' inside the text...
@@ -854,7 +853,7 @@ FormTokenType SwFormTokensHelper::GetTokenType(const OUString & sToken,
         }
     }
 
-    OSL_FAIL( "wrong token" );
+    SAL_WARN("sw.core", "SwFormTokensHelper: invalid token");
     return TOKEN_END;
 }