summaryrefslogtreecommitdiff
path: root/lotuswordpro/source/filter/lwptoc.cxx
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2015-12-10 12:59:21 +0000
committerCaolán McNamara <caolanm@redhat.com>2015-12-10 13:02:44 +0000
commitbe413828f13871100f99ba17b37e59bb95158ab9 (patch)
tree1983d78a1556c600cee664f5fcd24886598bb70e /lotuswordpro/source/filter/lwptoc.cxx
parent04bd61251de98087126bb5a41f10817b505f5af3 (diff)
guard against corrupt LwpTocSuperLayout
Change-Id: I18648e74d16b932cfa6fbd2057d1e9987c498fd4 (cherry picked from commit e0dca588239c0902ea90fcdc2b6d0ee2b1525ec2)
Diffstat (limited to 'lotuswordpro/source/filter/lwptoc.cxx')
-rw-r--r--lotuswordpro/source/filter/lwptoc.cxx13
1 files changed, 9 insertions, 4 deletions
diff --git a/lotuswordpro/source/filter/lwptoc.cxx b/lotuswordpro/source/filter/lwptoc.cxx
index 9650d7f2d962..905e37978b8d 100644
--- a/lotuswordpro/source/filter/lwptoc.cxx
+++ b/lotuswordpro/source/filter/lwptoc.cxx
@@ -101,17 +101,22 @@ void LwpTocSuperLayout::Read()
m_SearchItems.Read(m_pObjStrm);
- sal_uInt16 i;
sal_uInt16 count = m_pObjStrm->QuickReaduInt16();
- for (i = 0; (i < MAX_LEVELS) && (count > 0); i++, count--)
+ if (count > MAX_LEVELS)
+ throw std::range_error("corrupt LwpTocSuperLayout");
+ for (sal_uInt16 i = 0; i < count; ++i)
m_DestName[i].Read(m_pObjStrm);
count = m_pObjStrm->QuickReaduInt16();
- for (i = 0; (i < MAX_LEVELS) && (count > 0); i++, count--)
+ if (count > MAX_LEVELS)
+ throw std::range_error("corrupt LwpTocSuperLayout");
+ for (sal_uInt16 i = 0; i < count; ++i)
m_DestPGName[i].Read(m_pObjStrm);
count = m_pObjStrm->QuickReaduInt16();
- for (i = 0; i < count; i++)
+ if (count > MAX_LEVELS)
+ throw std::range_error("corrupt LwpTocSuperLayout");
+ for (sal_uInt16 i = 0; i < count; ++i)
m_nFlags[i] = m_pObjStrm->QuickReaduInt32();
m_pObjStrm->SkipExtra();