diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-12-10 12:59:21 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-12-10 13:01:58 +0000 |
| commit | e0dca588239c0902ea90fcdc2b6d0ee2b1525ec2 (patch) | |
| tree | 668e4bf4ebc7d9f6d2ab0fa5ae918e165283d30d /lotuswordpro | |
| parent | da0b49f808825884f045bba6689be13d33d58a47 (diff) | |
guard against corrupt LwpTocSuperLayout
Change-Id: I18648e74d16b932cfa6fbd2057d1e9987c498fd4
Diffstat (limited to 'lotuswordpro')
| -rw-r--r-- | lotuswordpro/source/filter/lwptoc.cxx | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/lotuswordpro/source/filter/lwptoc.cxx b/lotuswordpro/source/filter/lwptoc.cxx index 9650d7f2d962..905e37978b8d 100644 --- a/lotuswordpro/source/filter/lwptoc.cxx +++ b/lotuswordpro/source/filter/lwptoc.cxx @@ -101,17 +101,22 @@ void LwpTocSuperLayout::Read() m_SearchItems.Read(m_pObjStrm); - sal_uInt16 i; sal_uInt16 count = m_pObjStrm->QuickReaduInt16(); - for (i = 0; (i < MAX_LEVELS) && (count > 0); i++, count--) + if (count > MAX_LEVELS) + throw std::range_error("corrupt LwpTocSuperLayout"); + for (sal_uInt16 i = 0; i < count; ++i) m_DestName[i].Read(m_pObjStrm); count = m_pObjStrm->QuickReaduInt16(); - for (i = 0; (i < MAX_LEVELS) && (count > 0); i++, count--) + if (count > MAX_LEVELS) + throw std::range_error("corrupt LwpTocSuperLayout"); + for (sal_uInt16 i = 0; i < count; ++i) m_DestPGName[i].Read(m_pObjStrm); count = m_pObjStrm->QuickReaduInt16(); - for (i = 0; i < count; i++) + if (count > MAX_LEVELS) + throw std::range_error("corrupt LwpTocSuperLayout"); + for (sal_uInt16 i = 0; i < count; ++i) m_nFlags[i] = m_pObjStrm->QuickReaduInt32(); m_pObjStrm->SkipExtra(); |