[Libreoffice-commits] core.git: Branch 'libreoffice-5-0-4' - lotuswordpro/source

[Caolán McNamara]

 lotuswordpro/source/filter/lwpidxmgr.cxx  |    5 ++++-
 lotuswordpro/source/filter/lwptabrack.cxx |    2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

New commits:
commit 7097ee0c9e54b3d1303b4cb5d8aff2cf509e466b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Dec 9 11:28:52 2015 +0000

    guard against corrupt RootData
    
    Change-Id: Iad2788a7e5e7ee3b3107eab37cde2d3d38eae005
    (cherry picked from commit fc943ea85a7924ce0552b08eef99ed8e02f0b965)
    Reviewed-on: https://gerrit.libreoffice.org/20497
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/lotuswordpro/source/filter/lwpidxmgr.cxx b/lotuswordpro/source/filter/lwpidxmgr.cxx
index 07ea4a1..d6720e7 100644
--- a/lotuswordpro/source/filter/lwpidxmgr.cxx
+++ b/lotuswordpro/source/filter/lwpidxmgr.cxx
@@ -154,7 +154,10 @@ void LwpIndexManager::ReadRootData(LwpObjectStream* pObjStrm)
     sal_uInt16 KeyCount = pObjStrm->QuickReaduInt16();
     m_nLeafCount = KeyCount ? KeyCount + 1 : 0;
 
-    if(KeyCount)
+    if (m_nLeafCount > SAL_N_ELEMENTS(m_ChildIndex))
+        throw std::range_error("corrupt RootData");
+
+    if (KeyCount)
     {
         //read object keys
         LwpKey* akey = new LwpKey();
diff --git a/lotuswordpro/source/filter/lwptabrack.cxx b/lotuswordpro/source/filter/lwptabrack.cxx
index 8295796..f3c86d0 100644
--- a/lotuswordpro/source/filter/lwptabrack.cxx
+++ b/lotuswordpro/source/filter/lwptabrack.cxx
@@ -90,7 +90,7 @@ void LwpTabRack::Read()
 
     m_nNumTabs = m_pObjStrm->QuickReaduInt16();
     if (m_nNumTabs > MaxTabs)
-        throw std::out_of_range("corrupt LwpTabRack");
+        throw std::range_error("corrupt LwpTabRack");
     for (int i=0; i<m_nNumTabs; ++i)
     {
         m_aTabs[i].Read(m_pObjStrm);