Related: i#86517 avoid crash on invalid LEVELTEXT

1 files changed, 5 insertions, 1 deletions

diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
index ffc3846547b6..3b799370838a 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
@@ -2794,7 +2794,11 @@ int RTFDocumentImpl::popState()
 
         // The first character is the length of the string (the rest should be ignored).
         sal_Int32 nLength(aStr.toChar());
-        OUString aValue = aStr.copy(1, nLength);
+        OUString aValue;
+        if (nLength <= aStr.getLength())
+            aValue = aStr.copy(1, nLength);
+        else
+            aValue = aStr;
         RTFValue::Pointer_t pValue(new RTFValue(aValue, true));
         m_aStates.top().aTableAttributes->push_back(make_pair(NS_ooxml::LN_CT_LevelText_val, pValue));