ofz#3201: avoid oom

Change-Id: Ia8e171a003f24c73c7f53ca7240e03c6f2492ad3
Reviewed-on: https://gerrit.libreoffice.org/41670
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 13 insertions, 11 deletions

diff --git a/hwpfilter/source/hwpfile.cxx b/hwpfilter/source/hwpfile.cxx
index 43fad53c3829..a693f15d3d55 100644
--- a/hwpfilter/source/hwpfile.cxx
+++ b/hwpfilter/source/hwpfile.cxx
@@ -174,32 +174,27 @@ size_t HWPFile::Read1b(void *ptr, size_t nmemb)
     return hiodev ? hiodev->read1b(ptr, nmemb) : 0;
 }
 
-void HWPFile::Read2b(void *ptr, size_t nmemb)
+size_t HWPFile::Read2b(void *ptr, size_t nmemb)
 {
-    if (hiodev)
-        hiodev->read2b(ptr, nmemb);
+    return hiodev ? hiodev->read2b(ptr, nmemb) : 0;
 }
 
-
 void HWPFile::Read4b(void *ptr, size_t nmemb)
 {
     if (hiodev)
         hiodev->read4b(ptr, nmemb);
 }
 
-
 size_t HWPFile::ReadBlock(void *ptr, size_t size)
 {
     return hiodev ? hiodev->readBlock(ptr, size) : 0;
 }
 
-
 size_t HWPFile::SkipBlock(size_t size)
 {
     return hiodev ? hiodev->skipBlock(size) : 0;
 }
 
-
 void HWPFile::SetCompressed(bool flag)
 {
     if (hiodev)
@@ -313,15 +308,22 @@ void HWPFile::TagsRead()
                 break;
             case FILETAG_HYPERTEXT:
             {
-                if( (size % 617) != 0 )
+                const int nRecordLen = 617;
+                if( (size % nRecordLen) != 0 )
                     SkipBlock( size );
                 else
                 {
-                    for( int i = 0 ; i < size/617 ; i++)
+                    const int nRecords = size / nRecordLen;
+                    for (int i = 0 ; i < nRecords; ++i)
                     {
                         HyperText *hypert = new HyperText;
-                        hypert->Read(*this);
-                        hyperlist.push_back(hypert);
+                        if (hypert->Read(*this))
+                            hyperlist.push_back(hypert);
+                        else
+                        {
+                            delete hypert;
+                            break;
+                        }
                     }
                 }
                 break;