sw/source/filter/ww8/ww8scan.cxx | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
New commits:
commit 3be7c158184b1b9fd60d71a59a02c8738bdf977e
Author: Caolán McNamara <caol...@redhat.com>
Date: Sat May 6 15:29:50 2017 +0100
ofz avoid oom
Change-Id: Ibfa71bc898ff97c2a50528c8396b1d17dcbf30b7
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 1410d42dab34..2e3e2fc9cf4a 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -6368,6 +6368,14 @@ void MSOPropertyBagStore::Read(SvStream& rStream)
sal_uInt32 nCste(0);
rStream.ReadUInt32(nCste);
+ //each string has a 2 byte len record at the start
+ const size_t nMaxPossibleRecords = rStream.remainingSize() /
sizeof(sal_uInt16);
+ if (nCste > nMaxPossibleRecords)
+ {
+ SAL_WARN("sw.ww8", nCste << " records claimed, but max possible is "
<< nMaxPossibleRecords);
+ nCste = nMaxPossibleRecords;
+ }
+
for (sal_uInt32 i = 0; i < nCste; ++i)
{
OUString aString = MSOPBString::Read(rStream);
@@ -6419,7 +6427,7 @@ void MSOPropertyBag::Read(SvStream& rStream)
rStream.ReadUInt16(cProp);
rStream.SeekRel(2); // cbUnknown
//each MSOProperty is 8 bytes in size
- size_t nMaxPossibleRecords = rStream.remainingSize() / 8;
+ const size_t nMaxPossibleRecords = rStream.remainingSize() / 8;
if (cProp > nMaxPossibleRecords)
{
SAL_WARN("sw.ww8", cProp << " records claimed, but max possible is "
<< nMaxPossibleRecords);
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
