[Libreoffice-commits] core.git: Branch 'libreoffice-4-3' - sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8par.cxx |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

New commits:
commit f35d61f021fc46b48ca1978ef6092e56a25c446a
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jan 9 11:30:00 2015 +0000

    asan: global-buffer-overflow on ooo12093-1.doc
    
    Change-Id: I5e29626fe2803d2751bdec9c6919662ea37cf64c
    Reviewed-on: https://gerrit.libreoffice.org/13820
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index cb2a23f..1185d90 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -5082,7 +5082,8 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss, const SwPosition &rPos)
 
         aInfo.ePos = FTNPOS_PAGE;
         aInfo.eNum = eNumA[pWDop->rncFtn];
-        aInfo.aFmt.SetNumberingType( static_cast< sal_uInt16 >(eNumTA[pWDop->nfcFtnRef]) );
+        sal_uInt16 nfcFtnRef = pWDop->nfcFtnRef & 0xF;
+        aInfo.aFmt.SetNumberingType( static_cast< sal_uInt16 >(eNumTA[nfcFtnRef]) );
         if( pWDop->nFtn )
             aInfo.nFtnOffset = pWDop->nFtn - 1;
         rDoc.SetFtnInfo( aInfo );
@@ -5091,8 +5092,8 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss, const SwPosition &rPos)
     {
         SwEndNoteInfo aInfo;
         aInfo = rDoc.GetEndNoteInfo(); // Same as for Ftn
-
-        aInfo.aFmt.SetNumberingType( static_cast< sal_uInt16 >(eNumTA[pWDop->nfcEdnRef]) );
+        sal_uInt16 nfcEdnRef = pWDop->nfcEdnRef & 0xF;
+        aInfo.aFmt.SetNumberingType( static_cast< sal_uInt16 >(eNumTA[nfcEdnRef]) );
         if( pWDop->nEdn )
             aInfo.nFtnOffset = pWDop->nEdn - 1;
         rDoc.SetEndNoteInfo( aInfo );