From 96f39ec02da9f29f9087f3072a184b38c95813dd Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>

Date: Mon, 13 Jul 2015 10:31:30 +0100

Subject: [PATCH 3/4] ww8: make sure we don't wrap around

Change-Id: I667bb264f92024b72f230c2ddbba3887471345f2

(cherry picked from commit 755b9320c81948358a1d4104c8875594b5700d39)

Reviewed-on: https://gerrit.libreoffice.org/16981

Reviewed-by: David Tardon <dtardon@redhat.com>

Tested-by: David Tardon <dtardon@redhat.com>

(cherry picked from commit 9f0044e16a42930d447f63e6129e9979f5e186ec)

---

 sw/source/filter/ww8/ww8scan.cxx | 4 ++++

 1 file changed, 4 insertions(+)

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx

index fceb5c3..f9f88a3 100644

--- a/sw/source/filter/ww8/ww8scan.cxx

+++ b/sw/source/filter/ww8/ww8scan.cxx

@@ -1540,7 +1540,11 @@ WW8PLCFpcd* WW8ScannerBase::OpenPieceTable( SvStream* pStr, const WW8Fib* pWwF )

         if( 2 == clxt )                         // PLCFfpcd ?

             break;                              // PLCFfpcd gefunden

         if( 1 == clxt )                         // clxtGrpprl ?

+        {

+            if (nGrpprl == SHRT_MAX)

+                return NULL;

             nGrpprl++;

+        }

         sal_uInt16 nLen(0);

         pStr->ReadUInt16( nLen );

         nLeft -= 2 + nLen;

-- 

2.5.0