ofz#1270 avoid oom

Change-Id: Iedf0ffdedea1ccda9276763c9d39924c3ff8943b

3 files changed, 13 insertions, 0 deletions

diff --git a/lotuswordpro/source/filter/bencont.cxx b/lotuswordpro/source/filter/bencont.cxx
index 8d67e3905963..ed15dc9858a6 100644
--- a/lotuswordpro/source/filter/bencont.cxx
+++ b/lotuswordpro/source/filter/bencont.cxx
@@ -332,6 +332,11 @@ void LtcBenContainer::CreateGraphicStream(SvStream * &pStream, const char *pObje
     pStream = pMemStream;
 }
 
+sal_uLong LtcBenContainer::remainingSize() const
+{
+    return m_ulLength - cpStream->Tell();
+}
+
 }// end namespace OpenStormBento
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/lotuswordpro/source/filter/bento.hxx b/lotuswordpro/source/filter/bento.hxx
index f5f2408d4036..9471590ed6ef 100644
--- a/lotuswordpro/source/filter/bento.hxx
+++ b/lotuswordpro/source/filter/bento.hxx
@@ -209,6 +209,7 @@ public: // Internal methods
     explicit LtcBenContainer(LwpSvStream * pStream);
     ~LtcBenContainer();
 
+    sal_uLong remainingSize() const;
     BenError Read(void * pBuffer, unsigned long MaxSize,
       unsigned long * pAmtRead);
     BenError ReadKnownSize(void * pBuffer, unsigned long Amt);
diff --git a/lotuswordpro/source/filter/tocread.cxx b/lotuswordpro/source/filter/tocread.cxx
index b6c32955411b..8e7e79a855e4 100644
--- a/lotuswordpro/source/filter/tocread.cxx
+++ b/lotuswordpro/source/filter/tocread.cxx
@@ -267,6 +267,13 @@ CBenTOCReader::ReadTOC()
                     if ((Err = cpContainer->SeekToPosition(Pos)) != BenErr_OK)
                         return Err;
 
+                    const auto nRemainingSize = cpContainer->remainingSize();
+                    if (Length > nRemainingSize)
+                    {
+                        SAL_WARN("lwp", "stream too short for claimed no of records");
+                        Length = nRemainingSize;
+                    }
+
                     #define STACK_BUFFER_SIZE 256
                     char sStackBuffer[STACK_BUFFER_SIZE];
                     char * sAllocBuffer;