[Libreoffice-commits] .: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

New commits:
commit af6f8242ea9b61841f3be23fc5eaca4da79e264a
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Aug 8 14:40:08 2012 +0100

    ensure lcbAtrdExtra is a sane size
    
    Change-Id: I766f8683655eb8f1ca437ab9622f3caefbc83e64

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index cd5d1ff..fcb61b7 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -1718,11 +1718,10 @@ WW8ScannerBase::WW8ScannerBase( SvStream* pSt, SvStream* pTblSt,
             if (pWwFib->fcAtrdExtra && pWwFib->lcbAtrdExtra)
             {
                 sal_Size nOldPos = pTblSt->Tell();
-                if (checkSeek(*pTblSt, pWwFib->fcAtrdExtra))
+                if (checkSeek(*pTblSt, pWwFib->fcAtrdExtra) && (pTblSt->remainingSize() >= pWwFib->lcbAtrdExtra))
                 {
                     pExtendedAtrds = new sal_uInt8[pWwFib->lcbAtrdExtra];
-                    pWwFib->lcbAtrdExtra = pTblSt->Read(pExtendedAtrds,
-                        pWwFib->lcbAtrdExtra);
+                    pWwFib->lcbAtrdExtra = pTblSt->Read(pExtendedAtrds, pWwFib->lcbAtrdExtra);
                 }
                 else
                     pWwFib->lcbAtrdExtra = 0;