[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

New commits:
commit 3be7c158184b1b9fd60d71a59a02c8738bdf977e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat May 6 15:29:50 2017 +0100

    ofz avoid oom
    
    Change-Id: Ibfa71bc898ff97c2a50528c8396b1d17dcbf30b7

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 1410d42dab34..2e3e2fc9cf4a 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -6368,6 +6368,14 @@ void MSOPropertyBagStore::Read(SvStream& rStream)
     sal_uInt32 nCste(0);
     rStream.ReadUInt32(nCste);
 
+    //each string has a 2 byte len record at the start
+    const size_t nMaxPossibleRecords = rStream.remainingSize() / sizeof(sal_uInt16);
+    if (nCste > nMaxPossibleRecords)
+    {
+        SAL_WARN("sw.ww8", nCste << " records claimed, but max possible is " << nMaxPossibleRecords);
+        nCste = nMaxPossibleRecords;
+    }
+
     for (sal_uInt32 i = 0; i < nCste; ++i)
     {
         OUString aString = MSOPBString::Read(rStream);
@@ -6419,7 +6427,7 @@ void MSOPropertyBag::Read(SvStream& rStream)
     rStream.ReadUInt16(cProp);
     rStream.SeekRel(2); // cbUnknown
     //each MSOProperty is 8 bytes in size
-    size_t nMaxPossibleRecords = rStream.remainingSize() / 8;
+    const size_t nMaxPossibleRecords = rStream.remainingSize() / 8;
     if (cProp > nMaxPossibleRecords)
     {
         SAL_WARN("sw.ww8", cProp << " records claimed, but max possible is " << nMaxPossibleRecords);