[Libreoffice-commits] .: Branch 'libreoffice-3-4' - sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 0772860756b7646391ade432e069032dd6d8d277
Author: Marc-Andre Laverdiere <marc-andre at atc.tcs.com>
Date:   Mon Jul 25 18:07:47 2011 +0530

    Fixed invalid array bounds read in ww8scan.cxx
    (cherry picked from commit a1c11fa56aef80b4a9a47054029613fb06a30832)

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 804b016..bc25f1a 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -6298,7 +6298,8 @@ WW8Fonts::WW8Fonts( SvStream& rSt, WW8Fib& rFib )
                 if ((eEnc == RTL_TEXTENCODING_SYMBOL) || (eEnc == RTL_TEXTENCODING_DONTKNOW))
                     eEnc = RTL_TEXTENCODING_MS_1252;
                 p->sFontname = String(pVer6->szFfn, eEnc);
-                if (p->ibszAlt)
+                const sal_uInt16 maxStrSize = SAL_N_ELEMENTS(pVer6->szFfn);
+                if (p->ibszAlt && p->ibszAlt < maxStrSize) //don't start after end of string
                 {
                     p->sFontname.Append(';');
                     p->sFontname += String(pVer6->szFfn+p->ibszAlt, eEnc);