avoid hang with certain .docs

(cherry picked from commit 9b0cd9196e05ab465ebf14a6264d087df224fb55)

Change-Id: I4dc93242be76dc2d7f7504457967c8d390afe9c8
Reviewed-on: https://gerrit.libreoffice.org/17644
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>

3 files changed, 22 insertions, 11 deletions

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 7489ca5a2d3e..0215253011f8 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -2141,7 +2141,7 @@ void WW8ReaderSave::Restore( SwWW8ImplReader* pRdr )
 }
 
 void SwWW8ImplReader::Read_HdFtFtnText( const SwNodeIndex* pSttIdx,
-    long nStartCp, long nLen, ManTypes nType )
+    WW8_CP nStartCp, WW8_CP nLen, ManTypes nType )
 {
     // Saves Flags (amongst other things) and resets them
     WW8ReaderSave aSave( this );
@@ -2228,7 +2228,7 @@ long SwWW8ImplReader::Read_And(WW8PLCFManResult* pRes)
     return 0;
 }
 
-void SwWW8ImplReader::Read_HdFtTextAsHackedFrame(long nStart, long nLen,
+void SwWW8ImplReader::Read_HdFtTextAsHackedFrame(WW8_CP nStart, WW8_CP nLen,
     SwFrmFmt &rHdFtFmt, sal_uInt16 nPageWidth)
 {
     const SwNodeIndex* pSttIdx = rHdFtFmt.GetCntnt().GetCntntIdx();
@@ -2272,7 +2272,7 @@ void SwWW8ImplReader::Read_HdFtTextAsHackedFrame(long nStart, long nLen,
     MoveOutsideFly(pFrame, aTmpPos);
 }
 
-void SwWW8ImplReader::Read_HdFtText(long nStart, long nLen, SwFrmFmt* pHdFtFmt)
+void SwWW8ImplReader::Read_HdFtText(WW8_CP nStart, WW8_CP nLen, SwFrmFmt* pHdFtFmt)
 {
     const SwNodeIndex* pSttIdx = pHdFtFmt->GetCntnt().GetCntntIdx();
     if (!pSttIdx)
@@ -3877,6 +3877,8 @@ void SwWW8ImplReader::ReadAttrs(WW8_CP& rNext, WW8_CP& rTxtPos, bool& rbStartLin
         {
             maCurrAttrCP = rTxtPos;
             rNext = ReadTextAttr( rTxtPos, rbStartLine );
+            if (rTxtPos == rNext && rTxtPos == WW8_CP_MAX)
+                break;
         }
         while( rTxtPos >= rNext );
 
@@ -3918,7 +3920,7 @@ void SwWW8ImplReader::CloseAttrEnds()
     EndSpecial();
 }
 
-bool SwWW8ImplReader::ReadText(long nStartCp, long nTextLen, ManTypes nType)
+bool SwWW8ImplReader::ReadText(WW8_CP nStartCp, WW8_CP nTextLen, ManTypes nType)
 {
     bool bJoined=false;
 
@@ -3944,6 +3946,12 @@ bool SwWW8ImplReader::ReadText(long nStartCp, long nTextLen, ManTypes nType)
     pStrm->Seek( pSBase->WW8Cp2Fc( nStartCp + nCpOfs, &bIsUnicode ) );
 
     WW8_CP l = nStartCp;
+    const WW8_CP nMaxPossible = WW8_CP_MAX-nStartCp;
+    if (nTextLen > nMaxPossible)
+    {
+        SAL_WARN_IF(nTextLen > nMaxPossible, "sw.ww8", "TextLen too long");
+        nTextLen = nMaxPossible;
+    }
     while ( l<nStartCp+nTextLen )
     {
         ReadAttrs( nNext, l, bStartLine );// Takes SectionBreaks into account, too
diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index b3f5c169f10d..34f1ff475082 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -1403,9 +1403,9 @@ private:
 
     void Read_HdFt(int nSect, const SwPageDesc *pPrev,
         const wwSection &rSection);
-    void Read_HdFtText(long nStartCp, long nLen, SwFrmFmt* pHdFtFmt);
-    void Read_HdFtTextAsHackedFrame(long nStart, long nLen,
-        SwFrmFmt &rHdFtFmt, sal_uInt16 nPageWidth);
+    void Read_HdFtText(WW8_CP nStartCp, WW8_CP nLen, SwFrmFmt* pHdFtFormat);
+    void Read_HdFtTextAsHackedFrame(WW8_CP nStart, WW8_CP nLen,
+        SwFrmFmt &rHdFtFormat, sal_uInt16 nPageWidth);
 
     bool isValid_HdFt_CP(WW8_CP nHeaderCP) const;
 
@@ -1442,13 +1442,13 @@ private:
     long ReadTextAttr(WW8_CP& rTxtPos, bool& rbStartLine);
     void ReadAttrs(WW8_CP& rNext, WW8_CP& rTxtPos, bool& rbStartLine);
     void CloseAttrEnds();
-    bool ReadText(long nStartCp, long nTextLen, ManTypes nType);
+    bool ReadText(WW8_CP nStartCp, WW8_CP nTextLen, ManTypes nType);
 
     void ReadRevMarkAuthorStrTabl( SvStream& rStrm, sal_Int32 nTblPos,
         sal_Int32 nTblSiz, SwDoc& rDoc );
 
-    void Read_HdFtFtnText( const SwNodeIndex* pSttIdx, long nStartCp,
-                           long nLen, ManTypes nType );
+    void Read_HdFtFtnText( const SwNodeIndex* pSttIdx, WW8_CP nStartCp,
+                           WW8_CP nLen, ManTypes nType );
 
     void ImportTox( int nFldId, const OUString& aStr );
 
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 5fae5700539e..93583c4ba0d0 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -3825,12 +3825,15 @@ void WW8PLCFx_FLD::GetSprms(WW8PLCFxDesc* p)
 
 void WW8PLCFx_FLD::advance()
 {
+    SAL_WARN_IF(!pPLCF, "sw.ww8", "Call without PLCFspecial field");
+    if( !pPLCF )
+        return;
     pPLCF->advance();
 }
 
 bool WW8PLCFx_FLD::GetPara(long nIdx, WW8FieldDesc& rF)
 {
-    OSL_ENSURE( pPLCF, "Call without PLCFspecial field" );
+    SAL_WARN_IF(!pPLCF, "sw.ww8", "Call without PLCFspecial field");
     if( !pPLCF )
         return false;