[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - sw/qa sw/source

[Caolán McNamara]

 sw/qa/core/data/ww8/pass/crash-2.doc |binary
 sw/source/filter/ww8/WW8Sttbf.cxx    |    2 ++
 2 files changed, 2 insertions(+)

New commits:
commit 20e5a9e8c07ca7462b770449f3e329c1ba09eba3
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Aug 16 14:20:54 2015 +0100

    clip Sttbf to available data
    
    Change-Id: Iaa6a8a8505a28cf3c24a48f832bfc618b39c3f32
    (cherry picked from commit 12143f8f84b07057d67d5cd6cc9ff6063dfa41f8)
    Reviewed-on: https://gerrit.libreoffice.org/17785
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/sw/qa/core/data/ww8/pass/crash-2.doc b/sw/qa/core/data/ww8/pass/crash-2.doc
new file mode 100644
index 0000000..452e21e
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/crash-2.doc differ
diff --git a/sw/source/filter/ww8/WW8Sttbf.cxx b/sw/source/filter/ww8/WW8Sttbf.cxx
index 0fa8903..7e1f82c 100644
--- a/sw/source/filter/ww8/WW8Sttbf.cxx
+++ b/sw/source/filter/ww8/WW8Sttbf.cxx
@@ -36,6 +36,8 @@ namespace ww8
     {
         if (checkSeek(rSt, nPos))
         {
+            sal_Size nRemainingSize = rSt.remainingSize();
+            nSize = std::min<sal_uInt32>(nRemainingSize, nSize);
             mp_data.reset(new sal_uInt8[nSize]);
             mn_size = rSt.Read(mp_data.get(), nSize);
         }