diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-07-22 13:51:19 +0100 |
|---|---|---|
| committer | Michael Meeks <michael.meeks@collabora.com> | 2015-07-23 06:44:57 +0000 |
| commit | f158515d97934b33c4cb275efd10fd3b17b45df7 (patch) | |
| tree | 23a6244363cb27d02419cba04ab3ee3545b951cc /sw | |
| parent | 3e390f8c579fcec8d3eba71b8d8608eb74e03449 (diff) | |
xstUsrInitl contains max 9 chars
Change-Id: Ia40d037d7af6cd3a283aa12948e4c5565dcb2ae6
(cherry picked from commit cbea6a709f33babfb490ab1bd07cde8cc08114ac)
Reviewed-on: https://gerrit.libreoffice.org/17292
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Meeks <michael.meeks@collabora.com>
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/qa/core/data/ww8/pass/crash-1.doc | bin | 0 -> 10240 bytes | |||
| -rw-r--r-- | sw/source/filter/ww8/ww8par.cxx | 11 |
2 files changed, 7 insertions, 4 deletions
diff --git a/sw/qa/core/data/ww8/pass/crash-1.doc b/sw/qa/core/data/ww8/pass/crash-1.doc Binary files differnew file mode 100644 index 000000000000..9f6b25348c64 --- /dev/null +++ b/sw/qa/core/data/ww8/pass/crash-1.doc diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx index 04a1d7699735..ebcb334a6610 100644 --- a/sw/source/filter/ww8/ww8par.cxx +++ b/sw/source/filter/ww8/ww8par.cxx @@ -2170,15 +2170,18 @@ long SwWW8ImplReader::Read_And(WW8PLCFManResult* pRes) if (pA) sAuthor = *pA; else - sAuthor = OUString(pDescri->xstUsrInitl + 1, pDescri->xstUsrInitl[0], - RTL_TEXTENCODING_MS_1252); + { + const sal_uInt8 nLen = std::min<sal_uInt8>(pDescri->xstUsrInitl[0], + SAL_N_ELEMENTS(pDescri->xstUsrInitl)-1); + sAuthor = OUString(pDescri->xstUsrInitl + 1, nLen, RTL_TEXTENCODING_MS_1252); + } } else { const WW8_ATRD* pDescri = static_cast<const WW8_ATRD*>(pSD->GetData()); - { - const sal_uInt16 nLen = SVBT16ToShort(pDescri->xstUsrInitl[0]); + const sal_uInt16 nLen = std::min<sal_uInt16>(SVBT16ToShort(pDescri->xstUsrInitl[0]), + SAL_N_ELEMENTS(pDescri->xstUsrInitl)-1); OUStringBuffer aBuf; aBuf.setLength(nLen); for(sal_uInt16 nIdx = 1; nIdx <= nLen; ++nIdx) |