[Libreoffice-commits] core.git: Branch 'libreoffice-5-1' - lotuswordpro/source

[Caolán McNamara]

 lotuswordpro/source/filter/lwptoc.cxx |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

New commits:
commit be413828f13871100f99ba17b37e59bb95158ab9
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Dec 10 12:59:21 2015 +0000

    guard against corrupt LwpTocSuperLayout
    
    Change-Id: I18648e74d16b932cfa6fbd2057d1e9987c498fd4
    (cherry picked from commit e0dca588239c0902ea90fcdc2b6d0ee2b1525ec2)

diff --git a/lotuswordpro/source/filter/lwptoc.cxx b/lotuswordpro/source/filter/lwptoc.cxx
index 9650d7f..905e379 100644
--- a/lotuswordpro/source/filter/lwptoc.cxx
+++ b/lotuswordpro/source/filter/lwptoc.cxx
@@ -101,17 +101,22 @@ void LwpTocSuperLayout::Read()
 
     m_SearchItems.Read(m_pObjStrm);
 
-    sal_uInt16 i;
     sal_uInt16 count = m_pObjStrm->QuickReaduInt16();
-    for (i = 0; (i < MAX_LEVELS) && (count > 0); i++, count--)
+    if (count > MAX_LEVELS)
+        throw std::range_error("corrupt LwpTocSuperLayout");
+    for (sal_uInt16 i = 0; i < count; ++i)
         m_DestName[i].Read(m_pObjStrm);
 
     count = m_pObjStrm->QuickReaduInt16();
-    for (i = 0; (i < MAX_LEVELS) && (count > 0); i++, count--)
+    if (count > MAX_LEVELS)
+        throw std::range_error("corrupt LwpTocSuperLayout");
+    for (sal_uInt16 i = 0; i < count; ++i)
         m_DestPGName[i].Read(m_pObjStrm);
 
     count = m_pObjStrm->QuickReaduInt16();
-    for (i = 0; i < count; i++)
+    if (count > MAX_LEVELS)
+        throw std::range_error("corrupt LwpTocSuperLayout");
+    for (sal_uInt16 i = 0; i < count; ++i)
         m_nFlags[i] = m_pObjStrm->QuickReaduInt32();
 
     m_pObjStrm->SkipExtra();