[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - sw/qa sw/source

[Caolán McNamara]

 sw/qa/core/data/ww5/pass/hang-2.doc |binary
 sw/source/filter/ww8/ww8scan.cxx    |    9 ++++-----
 2 files changed, 4 insertions(+), 5 deletions(-)

New commits:
commit d8b8bb7bb6a4b50190efd9f1f6909f42e353546c
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 24 14:05:00 2015 +0100

    limit seeks to valid area
    
    (cherry picked from commit c0c9075163f06c0b5c2ad9cf428f1cfacf9fe1fb)
    
    Change-Id: I401d93491999a3fc3db4f597eea9c4fe5b9bc926
    Reviewed-on: https://gerrit.libreoffice.org/17955
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/sw/qa/core/data/ww5/pass/hang-2.doc b/sw/qa/core/data/ww5/pass/hang-2.doc
new file mode 100644
index 0000000..5f76093
Binary files /dev/null and b/sw/qa/core/data/ww5/pass/hang-2.doc differ
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 1dbf102..c227c12 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -6726,9 +6726,8 @@ WW8Dop::WW8Dop(SvStream& rSt, sal_Int16 nFib, sal_Int32 nPos, sal_uInt32 nSize)
     sal_uInt8* pData = pDataPtr;
 
     sal_uInt32 nRead = nMaxDopSize < nSize ? nMaxDopSize : nSize;
-    rSt.Seek( nPos );
-    if (2 > nSize || nRead != rSt.Read(pData, nRead))
-        nDopError = ERR_SWG_READ_ERROR;     // Error melden
+    if (nSize < 2 || !checkSeek(rSt, nPos) || nRead != rSt.Read(pData, nRead))
+        nDopError = ERR_SWG_READ_ERROR;     // report error
     else
     {
         if (nMaxDopSize > nRead)
@@ -7575,8 +7574,8 @@ SEPr::SEPr() :
 
 bool checkSeek(SvStream &rSt, sal_uInt32 nOffset)
 {
-    return (nOffset != SAL_MAX_UINT32 &&
-            rSt.Seek(nOffset) == static_cast<sal_Size>(nOffset));
+    const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize());
+    return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset);
 }
 
 bool checkRead(SvStream &rSt, void *pDest, sal_uInt32 nLength)