[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - sw/qa sw/source

[Caolán McNamara]

 sw/qa/core/data/ww5/pass/hang-1.doc |binary
 sw/source/filter/ww8/ww8scan.cxx    |   17 +++++++++++++++++
 sw/source/filter/ww8/ww8scan.hxx    |    1 +
 3 files changed, 18 insertions(+)

New commits:
commit cce05bd5e655ae1db7165e086183371bf071dae3
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 24 12:36:41 2015 +0100

    guard against hangs with bogus unsorted plcfs
    
    This reverts commit 6d21cbd1238556535ec1bb1adf35b25bc8eb898b.
    
    Change-Id: I309302ab5357b8404ee4c75bd0bfcb4f816e0588
    (cherry picked from commit 74c0f74422671f8005f2cfc0ae94e5656bcea31e)
    Reviewed-on: https://gerrit.libreoffice.org/17951
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/sw/qa/core/data/ww5/pass/hang-1.doc b/sw/qa/core/data/ww5/pass/hang-1.doc
new file mode 100644
index 0000000..6033724
Binary files /dev/null and b/sw/qa/core/data/ww5/pass/hang-1.doc differ
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 496e81a..1dbf102 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2125,6 +2125,8 @@ void WW8PLCF::ReadPLCF(SvStream& rSt, WW8_FC nFilePos, sal_uInt32 nPLCF)
 #endif // OSL_BIGENDIAN
         // Pointer to content array
         pPLCF_Contents = reinterpret_cast<sal_uInt8*>(&pPLCF_PosArray[nIMax + 1]);
+
+        TruncToSortedRange();
     }
 
     OSL_ENSURE(bValid, "Document has corrupt PLCF, ignoring it");
@@ -2144,6 +2146,21 @@ void WW8PLCF::MakeFailedPLCF()
     pPLCF_Contents = reinterpret_cast<sal_uInt8*>(&pPLCF_PosArray[nIMax + 1]);
 }
 
+void WW8PLCF::TruncToSortedRange()
+{
+    //Docs state that: ... all Plcs ... are sorted in ascending order.
+    //So ensure that here for broken documents.
+    for (auto nI = 0; nI < nIMax; ++nI)
+    {
+        if (pPLCF_PosArray[nI] > pPLCF_PosArray[nI+1])
+        {
+            SAL_WARN("sw.ww8", "Document has unsorted PLCF, truncated to sorted portion");
+            nIMax = nI;
+            break;
+        }
+    }
+}
+
 void WW8PLCF::GeneratePLCF(SvStream& rSt, sal_Int32 nPN, sal_Int32 ncpN)
 {
     OSL_ENSURE( nIMax < ncpN, "Pcl.Fkp: Why is PLCF too big?" );
diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx
index e1002f7..9b258af 100644
--- a/sw/source/filter/ww8/ww8scan.hxx
+++ b/sw/source/filter/ww8/ww8scan.hxx
@@ -291,6 +291,7 @@ private:
 
     void MakeFailedPLCF();
 
+    void TruncToSortedRange();
 public:
     WW8PLCF(SvStream& rSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
         WW8_CP nStartPos = -1);