[Libreoffice-commits] core.git: sw/qa sw/source

[Caolán McNamara]

 sw/qa/core/data/ww5/pass/hang-1.doc |binary
 sw/source/filter/ww8/ww8scan.cxx    |   17 +++++++++++++++++
 sw/source/filter/ww8/ww8scan.hxx    |    1 +
 3 files changed, 18 insertions(+)

New commits:
commit f3db01f313ac06f70bec7584f48a380ab832ca75
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 24 12:05:38 2015 +0100

    guard against hangs with bogus unsorted plcfs
    
    Change-Id: I91caff583617435add76503498ca4ed361eb5d2e

diff --git a/sw/qa/core/data/ww5/pass/hang-1.doc b/sw/qa/core/data/ww5/pass/hang-1.doc
new file mode 100644
index 0000000..6033724
Binary files /dev/null and b/sw/qa/core/data/ww5/pass/hang-1.doc differ
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 313dd78..05e2be9 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2101,6 +2101,8 @@ void WW8PLCF::ReadPLCF(SvStream& rSt, WW8_FC nFilePos, sal_uInt32 nPLCF)
 #endif // OSL_BIGENDIAN
         // Pointer to content array
         pPLCF_Contents = reinterpret_cast<sal_uInt8*>(&pPLCF_PosArray[nIMax + 1]);
+
+        TruncToSortedRange();
     }
 
     OSL_ENSURE(bValid, "Document has corrupt PLCF, ignoring it");
@@ -2120,6 +2122,21 @@ void WW8PLCF::MakeFailedPLCF()
     pPLCF_Contents = reinterpret_cast<sal_uInt8*>(&pPLCF_PosArray[nIMax + 1]);
 }
 
+void WW8PLCF::TruncToSortedRange()
+{
+    //Docs state that: ... all Plcs ... are sorted in ascending order.
+    //So ensure that here for broken documents.
+    for (auto nI = 0; nI < nIMax; ++nI)
+    {
+        if (pPLCF_PosArray[nI] >= pPLCF_PosArray[nI+1])
+        {
+            SAL_WARN("sw.ww8", "Document has unsorted PLCF, truncated to sorted portion");
+            nIMax = nI;
+            break;
+        }
+    }
+}
+
 void WW8PLCF::GeneratePLCF(SvStream& rSt, sal_Int32 nPN, sal_Int32 ncpN)
 {
     OSL_ENSURE( nIMax < ncpN, "Pcl.Fkp: Why is PLCF too big?" );
diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx
index 53e5d47..54e8165 100644
--- a/sw/source/filter/ww8/ww8scan.hxx
+++ b/sw/source/filter/ww8/ww8scan.hxx
@@ -291,6 +291,7 @@ private:
 
     void MakeFailedPLCF();
 
+    void TruncToSortedRange();
 public:
     WW8PLCF(SvStream& rSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
         WW8_CP nStartPos = -1);