From b4914ef4febf0fe6d0490af9b99ce93e61669370 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Wed, 5 Apr 2017 13:06:16 +0100 Subject: ofz: check available data len Change-Id: Ibb40e1d474bb0baacd57f136ff056e248b6f0c61 --- sw/source/filter/ww8/ww8par.cxx | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx index 01e4a86e73fe..1c843489449a 100644 --- a/sw/source/filter/ww8/ww8par.cxx +++ b/sw/source/filter/ww8/ww8par.cxx @@ -3428,9 +3428,17 @@ bool SwWW8ImplReader::ReadChars(WW8_CP& rPos, WW8_CP nNextAttr, long nTextEnd, if (m_bSymbol || m_bIgnoreText) { - if( m_bSymbol ) // Insert special chars + WW8_CP nRequested = nEnd - rPos; + if (m_bSymbol) // Insert special chars { - for(sal_uInt16 nCh = 0; nCh < nEnd - rPos; ++nCh) + sal_uInt64 nMaxPossible = m_pStrm->remainingSize(); + if (static_cast(nRequested) > nMaxPossible) + { + SAL_WARN("sw.ww8", "document claims to have more characters, " << nRequested << " than remaining, " << nMaxPossible); + nRequested = nMaxPossible; + } + + for (WW8_CP nCh = 0; nCh < nRequested; ++nCh) { m_rDoc.getIDocumentContentOperations().InsertString( *m_pPaM, OUString(m_cSymbol) ); } @@ -3438,7 +3446,7 @@ bool SwWW8ImplReader::ReadChars(WW8_CP& rPos, WW8_CP nNextAttr, long nTextEnd, m_pCtrlStck->SetAttr( *m_pPaM->GetPoint(), RES_CHRATR_CJK_FONT ); m_pCtrlStck->SetAttr( *m_pPaM->GetPoint(), RES_CHRATR_CTL_FONT ); } - m_pStrm->SeekRel( nEnd- rPos ); + m_pStrm->SeekRel(nRequested); rPos = nEnd; // Ignore until attribute end return false; } -- cgit v1.2.3