[Libreoffice-commits] core.git: Branch 'libreoffice-5-2-7' - sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8graf.cxx |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

New commits:
commit dadbcddf64301e96f7303c193884cb42fa00d21b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Apr 13 13:01:35 2017 +0100

    ofz: header has to be at least 1 pair long
    
    Change-Id: I5725048519a2b68265e90d12b1e4bcb506c56fc2
    (cherry picked from commit e72f3ce68e18ac604469ce5e856341a469af27ff)
    Reviewed-on: https://gerrit.libreoffice.org/36521
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/sw/source/filter/ww8/ww8graf.cxx b/sw/source/filter/ww8/ww8graf.cxx
index 0fe0bf5287cf..72ee4ea7d805 100644
--- a/sw/source/filter/ww8/ww8graf.cxx
+++ b/sw/source/filter/ww8/ww8graf.cxx
@@ -1253,12 +1253,20 @@ SdrObject* SwWW8ImplReader::ReadCaptionBox(WW8_DPHEAD* pHd, SfxAllItemSet &rSet)
         return nullptr;
 
     sal_uInt16 nCount = SVBT16ToShort( aCallB.dpPolyLine.aBits1 ) >> 1 & 0x7fff;
+    if (nCount < 1)
+    {
+        SAL_WARN("sw.ww8", "Short CaptionBox header");
+        return nullptr;
+    }
+
     std::unique_ptr<SVBT16[]> xP(new SVBT16[nCount * 2]);
 
     bool bCouldRead = checkRead(*m_pStrm, xP.get(), nCount * 4);      // Punkte einlesen
-    OSL_ENSURE(bCouldRead, "Short CaptionBox header");
     if (!bCouldRead)
+    {
+        SAL_WARN("sw.ww8", "Short CaptionBox header");
         return nullptr;
+    }
 
     sal_uInt8 nTyp = (sal_uInt8)nCount - 1;
     if( nTyp == 1 && SVBT16ToShort( xP[0] ) == SVBT16ToShort( xP[2] ) )