[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - sw/qa sw/source

[Caolán McNamara]

 sw/qa/core/data/ww8/pass/crash-1.doc |binary
 sw/source/filter/ww8/ww8par.cxx      |   11 +++++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

New commits:
commit f158515d97934b33c4cb275efd10fd3b17b45df7
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Jul 22 13:51:19 2015 +0100

    xstUsrInitl contains max 9 chars
    
    Change-Id: Ia40d037d7af6cd3a283aa12948e4c5565dcb2ae6
    (cherry picked from commit cbea6a709f33babfb490ab1bd07cde8cc08114ac)
    Reviewed-on: https://gerrit.libreoffice.org/17292
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/sw/qa/core/data/ww8/pass/crash-1.doc b/sw/qa/core/data/ww8/pass/crash-1.doc
new file mode 100644
index 0000000..9f6b253
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/crash-1.doc differ
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 04a1d76..ebcb334 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -2170,15 +2170,18 @@ long SwWW8ImplReader::Read_And(WW8PLCFManResult* pRes)
         if (pA)
             sAuthor = *pA;
         else
-            sAuthor = OUString(pDescri->xstUsrInitl + 1, pDescri->xstUsrInitl[0],
-                RTL_TEXTENCODING_MS_1252);
+        {
+            const sal_uInt8 nLen = std::min<sal_uInt8>(pDescri->xstUsrInitl[0],
+                                                       SAL_N_ELEMENTS(pDescri->xstUsrInitl)-1);
+            sAuthor = OUString(pDescri->xstUsrInitl + 1, nLen, RTL_TEXTENCODING_MS_1252);
+        }
     }
     else
     {
         const WW8_ATRD* pDescri = static_cast<const WW8_ATRD*>(pSD->GetData());
-
         {
-            const sal_uInt16 nLen = SVBT16ToShort(pDescri->xstUsrInitl[0]);
+            const sal_uInt16 nLen = std::min<sal_uInt16>(SVBT16ToShort(pDescri->xstUsrInitl[0]),
+                                                         SAL_N_ELEMENTS(pDescri->xstUsrInitl)-1);
             OUStringBuffer aBuf;
             aBuf.setLength(nLen);
             for(sal_uInt16 nIdx = 1; nIdx <= nLen; ++nIdx)