[Libreoffice-commits] core.git: Branch 'libreoffice-5-0-4' - lotuswordpro/source

[Caolán McNamara]

 lotuswordpro/source/filter/lwptabrack.cxx |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

New commits:
commit e3ece9c844435432269de62b7c666e6dd93adbf2
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Dec 8 14:20:52 2015 +0000

    guard against corrupt m_nNumTabs
    
    Change-Id: I41b8514a127d463ac951e5855f09416fa0456b1b
    (cherry picked from commit 85a2cd37fc60cd53a892b27a18d4b5272988361c)
    (cherry picked from commit 34a03c676e618200292f187f8f96b74f23c962b5)
    Reviewed-on: https://gerrit.libreoffice.org/20472
    Reviewed-by: Björn Michaelsen <bjoern.michaelsen at canonical.com>
    Reviewed-by: Stephan Bergmann <sbergman at redhat.com>
    Tested-by: Stephan Bergmann <sbergman at redhat.com>

diff --git a/lotuswordpro/source/filter/lwptabrack.cxx b/lotuswordpro/source/filter/lwptabrack.cxx
index 5c3eb44..8295796 100644
--- a/lotuswordpro/source/filter/lwptabrack.cxx
+++ b/lotuswordpro/source/filter/lwptabrack.cxx
@@ -86,11 +86,12 @@ LwpTabRack::LwpTabRack(LwpObjectHeader objHdr, LwpSvStream* pStrm):LwpObject(obj
 
 void LwpTabRack::Read()
 {
-//  LwpObjectID     m_NextID;
     m_NextID.ReadIndexed(m_pObjStrm);
 
     m_nNumTabs = m_pObjStrm->QuickReaduInt16();
-    for( int i=0; i<m_nNumTabs; i++ )
+    if (m_nNumTabs > MaxTabs)
+        throw std::out_of_range("corrupt LwpTabRack");
+    for (int i=0; i<m_nNumTabs; ++i)
     {
         m_aTabs[i].Read(m_pObjStrm);
         m_pObjStrm->SkipExtra();