[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - lotuswordpro/source

[Caolán McNamara]

 lotuswordpro/source/filter/lwpsilverbullet.cxx |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

New commits:
commit 4f78f0cca72ccd011c6e0af9225fb7b9004eac47
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Dec 9 12:09:37 2015 +0000

    guard against corrupt SilverBullet
    
    (cherry picked from commit 36d55980b1b3498fecc460d3c46667e5f5a17b8e)
    Reviewed-on: https://gerrit.libreoffice.org/20504
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit d387a99fce3f96f4fcd60c70909292255f12840f)
    
    Change-Id: I3af47ab3af5e28a865a77a592f6a92edb46e4f2b
    Reviewed-on: https://gerrit.libreoffice.org/20505
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/lotuswordpro/source/filter/lwpsilverbullet.cxx b/lotuswordpro/source/filter/lwpsilverbullet.cxx
index c0c39e9..e7ad33f 100644
--- a/lotuswordpro/source/filter/lwpsilverbullet.cxx
+++ b/lotuswordpro/source/filter/lwpsilverbullet.cxx
@@ -97,7 +97,10 @@ void LwpSilverBullet::Read()
 
     sal_uInt16 nNumPos = m_pObjStrm->QuickReaduInt16();
 
-    for (sal_uInt8 nC = 0; nC < nNumPos; nC++)
+    if (nNumPos > SAL_N_ELEMENTS(m_pResetPositionFlags))
+        throw std::range_error("corrupt SilverBullet");
+
+    for (sal_uInt16 nC = 0; nC < nNumPos; nC++)
         m_pResetPositionFlags[nC] = m_pObjStrm->QuickReaduInt8();
 
     m_nUseCount = m_pObjStrm->QuickReaduInt32();