[Libreoffice-commits] core.git: Branch 'libreoffice-4-1' - sw/qa sw/source

[Caolán McNamara]

 sw/qa/core/data/ww5/pass/ooo2535-1.doc |binary
 sw/qa/core/filters-test.cxx            |    4 ++++
 sw/source/filter/ww8/ww8scan.cxx       |   10 +++++++++-
 3 files changed, 13 insertions(+), 1 deletion(-)

New commits:
commit a39ff2fb213c6428ba5e11a9c55f353cdbdda70b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Sep 11 09:32:11 2013 +0100

    CID#736212 clip word 2 pap bounds
    
    and add a unit test for the word 2..5 formats
    
    Change-Id: I6c7c26be6092acbb81282080de6c393d92ad5dd4
    (cherry picked from commit 5d8a9d56de7c1217cfdbe2288c1a3a9128c3dbb5)
    Reviewed-on: https://gerrit.libreoffice.org/5908
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sw/qa/core/data/ww5/fail/.gitignore b/sw/qa/core/data/ww5/fail/.gitignore
new file mode 100644
index 0000000..e69de29
diff --git a/sw/qa/core/data/ww5/indeterminate/.gitignore b/sw/qa/core/data/ww5/indeterminate/.gitignore
new file mode 100644
index 0000000..e69de29
diff --git a/sw/qa/core/data/ww5/pass/.gitignore b/sw/qa/core/data/ww5/pass/.gitignore
new file mode 100644
index 0000000..e69de29
diff --git a/sw/qa/core/data/ww5/pass/ooo2535-1.doc b/sw/qa/core/data/ww5/pass/ooo2535-1.doc
new file mode 100644
index 0000000..2c594f5
Binary files /dev/null and b/sw/qa/core/data/ww5/pass/ooo2535-1.doc differ
diff --git a/sw/qa/core/filters-test.cxx b/sw/qa/core/filters-test.cxx
index 26fcd58..506e840 100644
--- a/sw/qa/core/filters-test.cxx
+++ b/sw/qa/core/filters-test.cxx
@@ -104,6 +104,10 @@ void SwFiltersTest::testCVEs()
             getURLFromSrc("/sw/qa/core/data/ww8/"),
             OUString(FILTER_WW8));
 
+    testDir(OUString("MS WinWord 5"),
+            getURLFromSrc("/sw/qa/core/data/ww5/"),
+            OUString(sWW5));
+
     testDir(OUString("Text (encoded)"),
             getURLFromSrc("/sw/qa/core/data/txt/"),
             OUString(FILTER_TEXT_DLG));
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 2c150cf..36f7ceb 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2496,7 +2496,15 @@ WW8PLCFx_Fc_FKP::WW8Fkp::WW8Fkp(ww::WordVersion eVersion, SvStream* pSt,
                                 {
                                     aEntry.mnLen-=6; //PHE
                                     //skipi stc, len byte + 6 byte PHE
-                                    aEntry.mpData = maRawData + nOfs + 8;
+                                    unsigned int nOffset = nOfs + 8;
+                                    if (nOffset >= 511) //Bad offset
+                                        aEntry.mnLen=0;
+                                    if (aEntry.mnLen)   //start is ok
+                                    {
+                                        if (nOffset + aEntry.mnLen > 512)   //Bad end, clip
+                                            aEntry.mnLen = 512 - nOffset;
+                                        aEntry.mpData = maRawData + nOffset;
+                                    }
                                 }
                                 else
                                     aEntry.mnLen=0; //Too short