From 96f39ec02da9f29f9087f3072a184b38c95813dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= Date: Mon, 13 Jul 2015 10:31:30 +0100 Subject: [PATCH 3/4] ww8: make sure we don't wrap around Change-Id: I667bb264f92024b72f230c2ddbba3887471345f2 (cherry picked from commit 755b9320c81948358a1d4104c8875594b5700d39) Reviewed-on: https://gerrit.libreoffice.org/16981 Reviewed-by: David Tardon Tested-by: David Tardon (cherry picked from commit 9f0044e16a42930d447f63e6129e9979f5e186ec) --- sw/source/filter/ww8/ww8scan.cxx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index fceb5c3..f9f88a3 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -1540,7 +1540,11 @@ WW8PLCFpcd* WW8ScannerBase::OpenPieceTable( SvStream* pStr, const WW8Fib* pWwF ) if( 2 == clxt ) // PLCFfpcd ? break; // PLCFfpcd gefunden if( 1 == clxt ) // clxtGrpprl ? + { + if (nGrpprl == SHRT_MAX) + return NULL; nGrpprl++; + } sal_uInt16 nLen(0); pStr->ReadUInt16( nLen ); nLeft -= 2 + nLen; -- 2.5.0