[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |    5 +++++
 1 file changed, 5 insertions(+)

New commits:
commit 75e7cc598fe9d61d9f6f3f96976b11e27627bc2f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Apr 4 12:31:04 2017 +0100

    ofz: guard against bogus sprm len
    
    Change-Id: I9b4074e1024753549f468f427afbfdf9cd01b674
    (cherry picked from commit d30fb62f4f1022ae6294e246974d0018596cf8ec)
    
    ofz: guard harder against bogus sprm len
    
    Change-Id: Ic82526e1454b24f094d3deee89647e88760bc44b
    (cherry picked from commit 924624b40a97d6925f66374259c2c21707805fcd)
    Reviewed-on: https://gerrit.libreoffice.org/36079
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index efb5da2614ca..9aa9a603f7ea 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -4896,6 +4896,11 @@ void WW8PLCFMan::GetSprmStart( short nIdx, WW8PLCFManResult* pRes ) const
     {
         // Length of actual sprm
         pRes->nMemLen = maSprmParser.GetSprmSize(pRes->nSprmId, pRes->pMemPos);
+        if (pRes->nMemLen > p->nSprmsLen)
+        {
+            SAL_WARN("sw.ww8", "Short sprm, len " << pRes->nMemLen << " claimed, max possible is " << p->nSprmsLen);
+            pRes->nSprmId = 0;
+        }
     }
 }