diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-08-28 12:13:41 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-09-01 16:17:23 +0200 |
| commit | dee0773acd8bf2c537e6574534824599f29feaab (patch) | |
| tree | 85f0dea883d274ce5847da770a2f2a0e49b6c23a /sw/source/filter/ww8/ww8par3.cxx | |
| parent | 51a45423c7ca4795f43659852fa8f2cd4320f858 (diff) | |
ofz#3154 check bounds of special sprm
Change-Id: I82566e2f2ad479c392f06ae7149e3781c0338e50
ofz: sanity check L_VAR2 record bounds
Change-Id: I862457a7239108974f360a87b4f6ccf433eae364
Reviewed-on: https://gerrit.libreoffice.org/37534
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 016e4d0e2650b2fb350068d86e8d392a7ef5acb1)
ofz: stay within available data
Change-Id: Ic959cf5b2cd92ba5bc297e686beb1fd50427a994
Reviewed-on: https://gerrit.libreoffice.org/36102
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit fdcac49119d3fc9f6216af834e7afc56d2c2e376)
Reviewed-on: https://gerrit.libreoffice.org/41648
Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit f33a136dc6bcb8bc0ed6ddd6c3d38d75e067e6eb)
Diffstat (limited to 'sw/source/filter/ww8/ww8par3.cxx')
| -rw-r--r-- | sw/source/filter/ww8/ww8par3.cxx | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx index f3211bac3b6b..7b1c37c76bdf 100644 --- a/sw/source/filter/ww8/ww8par3.cxx +++ b/sw/source/filter/ww8/ww8par3.cxx @@ -714,7 +714,7 @@ bool WW8ListManager::ReadLVL(SwNumFormat& rNumFormat, SfxItemSet*& rpItemSet, maSprmParser); while (const sal_uInt8* pSprm = aSprmIter.GetSprms()) { - rReader.ImportSprm(pSprm); + rReader.ImportSprm(pSprm, aSprmIter.GetRemLen(), aSprmIter.GetAktId()); aSprmIter.advance(); } @@ -1908,7 +1908,7 @@ void SwWW8ImplReader::RegisterNumFormatOnTextNode(sal_uInt16 nActLFO, sal_uInt8* pSprms1 = &aParaSprms[0]; while (0 < nLen) { - sal_uInt16 nL1 = ImportSprm(pSprms1); + sal_uInt16 nL1 = ImportSprm(pSprms1, nLen); nLen = nLen - nL1; pSprms1 += nL1; } |