[Libreoffice-commits] core.git: Branch 'libreoffice-5-4' - sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

New commits:
commit 0d6550f0fee06732d663b9763e18231dad4e42c5
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 28 12:13:41 2017 +0100

    ofz#3154 check bounds of special sprm
    
    Change-Id: I82566e2f2ad479c392f06ae7149e3781c0338e50
    Reviewed-on: https://gerrit.libreoffice.org/41631
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index e80ed34d4d13..ce322e6c0571 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -7953,8 +7953,17 @@ sal_uInt16 wwSprmParser::GetSprmTailLen(sal_uInt16 nId, const sal_uInt8* pSprm,
             }
             break;
         case 0xD608:
-            nL = SVBT16ToShort( &pSprm[1 + mnDelta] );
+        {
+            sal_uInt8 nIndex = 1 + mnDelta;
+            if (nIndex + 1 >= nRemLen)
+            {
+                SAL_WARN("sw.ww8", "sprm longer than remaining bytes, doc or parser is wrong");
+                nL = 0;
+            }
+            else
+                nL = SVBT16ToShort(&pSprm[nIndex]);
             break;
+        }
         default:
             switch (aSprm.nVari)
             {