avoid hang with certain .docs

Change-Id: I4dc93242be76dc2d7f7504457967c8d390afe9c8
(cherry picked from commit 9b0cd9196e05ab465ebf14a6264d087df224fb55)
Reviewed-on: https://gerrit.libreoffice.org/17647
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: David Tardon <dtardon@redhat.com>

4 files changed, 21 insertions, 10 deletions

diff --git a/sw/qa/core/data/ww8/pass/hang-2.doc b/sw/qa/core/data/ww8/pass/hang-2.doc
new file mode 100644
index 000000000000..6940c89e1315
--- /dev/null
+++ b/sw/qa/core/data/ww8/pass/hang-2.doc
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index ebcb334a6610..e3e4aaad8402 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -2139,7 +2139,7 @@ void WW8ReaderSave::Restore( SwWW8ImplReader* pRdr )
 }
 
 void SwWW8ImplReader::Read_HdFtFootnoteText( const SwNodeIndex* pSttIdx,
-    long nStartCp, long nLen, ManTypes nType )
+    WW8_CP nStartCp, WW8_CP nLen, ManTypes nType )
 {
     // Saves Flags (amongst other things) and resets them
     WW8ReaderSave aSave( this );
@@ -2226,7 +2226,7 @@ long SwWW8ImplReader::Read_And(WW8PLCFManResult* pRes)
     return 0;
 }
 
-void SwWW8ImplReader::Read_HdFtTextAsHackedFrame(long nStart, long nLen,
+void SwWW8ImplReader::Read_HdFtTextAsHackedFrame(WW8_CP nStart, WW8_CP nLen,
     SwFrameFormat &rHdFtFormat, sal_uInt16 nPageWidth)
 {
     const SwNodeIndex* pSttIdx = rHdFtFormat.GetContent().GetContentIdx();
@@ -2270,7 +2270,7 @@ void SwWW8ImplReader::Read_HdFtTextAsHackedFrame(long nStart, long nLen,
     MoveOutsideFly(pFrame, aTmpPos);
 }
 
-void SwWW8ImplReader::Read_HdFtText(long nStart, long nLen, SwFrameFormat* pHdFtFormat)
+void SwWW8ImplReader::Read_HdFtText(WW8_CP nStart, WW8_CP nLen, SwFrameFormat* pHdFtFormat)
 {
     const SwNodeIndex* pSttIdx = pHdFtFormat->GetContent().GetContentIdx();
     if (!pSttIdx)
@@ -3878,6 +3878,8 @@ void SwWW8ImplReader::ReadAttrs(WW8_CP& rNext, WW8_CP& rTextPos, bool& rbStartLi
         {
             m_aCurrAttrCP = rTextPos;
             rNext = ReadTextAttr( rTextPos, rbStartLine );
+            if (rTextPos == rNext && rTextPos == WW8_CP_MAX)
+                break;
         }
         while( rTextPos >= rNext );
 
@@ -3919,7 +3921,7 @@ void SwWW8ImplReader::CloseAttrEnds()
     EndSpecial();
 }
 
-bool SwWW8ImplReader::ReadText(long nStartCp, long nTextLen, ManTypes nType)
+bool SwWW8ImplReader::ReadText(WW8_CP nStartCp, WW8_CP nTextLen, ManTypes nType)
 {
     bool bJoined=false;
 
@@ -3945,6 +3947,12 @@ bool SwWW8ImplReader::ReadText(long nStartCp, long nTextLen, ManTypes nType)
     m_pStrm->Seek( m_pSBase->WW8Cp2Fc( nStartCp + nCpOfs, &m_bIsUnicode ) );
 
     WW8_CP l = nStartCp;
+    const WW8_CP nMaxPossible = WW8_CP_MAX-nStartCp;
+    if (nTextLen > nMaxPossible)
+    {
+        SAL_WARN_IF(nTextLen > nMaxPossible, "sw.ww8", "TextLen too long");
+        nTextLen = nMaxPossible;
+    }
     while ( l<nStartCp+nTextLen )
     {
         ReadAttrs( nNext, l, bStartLine );// Takes SectionBreaks into account, too
diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index afe7125c39f9..9f9160cf3533 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -1384,8 +1384,8 @@ private:
 
     void Read_HdFt(int nSect, const SwPageDesc *pPrev,
         const wwSection &rSection);
-    void Read_HdFtText(long nStartCp, long nLen, SwFrameFormat* pHdFtFormat);
-    void Read_HdFtTextAsHackedFrame(long nStart, long nLen,
+    void Read_HdFtText(WW8_CP nStartCp, WW8_CP nLen, SwFrameFormat* pHdFtFormat);
+    void Read_HdFtTextAsHackedFrame(WW8_CP nStart, WW8_CP nLen,
         SwFrameFormat &rHdFtFormat, sal_uInt16 nPageWidth);
 
     bool isValid_HdFt_CP(WW8_CP nHeaderCP) const;
@@ -1423,13 +1423,13 @@ private:
     long ReadTextAttr(WW8_CP& rTextPos, bool& rbStartLine);
     void ReadAttrs(WW8_CP& rNext, WW8_CP& rTextPos, bool& rbStartLine);
     void CloseAttrEnds();
-    bool ReadText(long nStartCp, long nTextLen, ManTypes nType);
+    bool ReadText(WW8_CP nStartCp, WW8_CP nTextLen, ManTypes nType);
 
     void ReadRevMarkAuthorStrTabl( SvStream& rStrm, sal_Int32 nTablePos,
         sal_Int32 nTableSiz, SwDoc& rDoc );
 
-    void Read_HdFtFootnoteText( const SwNodeIndex* pSttIdx, long nStartCp,
-                           long nLen, ManTypes nType );
+    void Read_HdFtFootnoteText(const SwNodeIndex* pSttIdx, WW8_CP nStartCp,
+                               WW8_CP nLen, ManTypes nType);
 
     void ImportTox( int nFieldId, const OUString& aStr );
 
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index c97db22e6b1a..165b9df74a55 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -3829,12 +3829,15 @@ void WW8PLCFx_FLD::GetSprms(WW8PLCFxDesc* p)
 
 void WW8PLCFx_FLD::advance()
 {
+    SAL_WARN_IF(!pPLCF, "sw.ww8", "Call without PLCFspecial field");
+    if( !pPLCF )
+        return;
     pPLCF->advance();
 }
 
 bool WW8PLCFx_FLD::GetPara(long nIdx, WW8FieldDesc& rF)
 {
-    OSL_ENSURE( pPLCF, "Call without PLCFspecial field" );
+    SAL_WARN_IF(!pPLCF, "sw.ww8", "Call without PLCFspecial field");
     if( !pPLCF )
         return false;