[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8toolbar.cxx |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

New commits:
commit c8e3a40a51a264455895535ea163a2c440f0851f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun May 7 21:45:27 2017 +0100

    ofc avoid oom
    
    Change-Id: I2983d97895206db481b990ccd4f0ecd9d8b31b81

diff --git a/sw/source/filter/ww8/ww8toolbar.cxx b/sw/source/filter/ww8/ww8toolbar.cxx
index b269f013da52..61208f586b79 100644
--- a/sw/source/filter/ww8/ww8toolbar.cxx
+++ b/sw/source/filter/ww8/ww8toolbar.cxx
@@ -946,7 +946,15 @@ bool PlfMcd::Read(SvStream &rS)
     nOffSet = rS.Tell();
     Tcg255SubStruct::Read( rS );
     rS.ReadInt32( iMac );
-    if ( iMac )
+    if (iMac < 0)
+        return false;
+    auto nMaxPossibleRecords = rS.remainingSize() / 24 /*sizeof MCD*/;
+    if (static_cast<sal_uInt32>(iMac) > nMaxPossibleRecords)
+    {
+        SAL_WARN("sw.ww8", iMac << " records claimed, but max possible is " << nMaxPossibleRecords);
+        iMac = nMaxPossibleRecords;
+    }
+    if (iMac)
     {
         rgmcd.resize(iMac);
         for ( sal_Int32 index = 0; index < iMac; ++index )