[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8scan.cxx  |   12 ++++++++----
 sw/source/filter/ww8/ww8struc.hxx |    2 +-
 2 files changed, 9 insertions(+), 5 deletions(-)

New commits:
commit 33013a5feb1cfbb8cb9ddd10083bc9ff470da160
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon May 8 08:54:22 2017 +0100

    ofz avoid oom
    
    Change-Id: I1cbcdc0aec8596fce4a803f885b328e604dc22fd

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 2e3e2fc9cf4a..df869cbc724b 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -6420,11 +6420,13 @@ MSOPropertyBag::MSOPropertyBag()
 {
 }
 
-void MSOPropertyBag::Read(SvStream& rStream)
+bool MSOPropertyBag::Read(SvStream& rStream)
 {
     rStream.ReadUInt16(m_nId);
     sal_uInt16 cProp(0);
     rStream.ReadUInt16(cProp);
+    if (!rStream.good())
+        return false;
     rStream.SeekRel(2); // cbUnknown
     //each MSOProperty is 8 bytes in size
     const size_t nMaxPossibleRecords = rStream.remainingSize() / 8;
@@ -6433,12 +6435,13 @@ void MSOPropertyBag::Read(SvStream& rStream)
         SAL_WARN("sw.ww8", cProp << " records claimed, but max possible is " << nMaxPossibleRecords);
         cProp = nMaxPossibleRecords;
     }
-    for (sal_uInt16 i = 0; i < cProp; ++i)
+    for (sal_uInt16 i = 0; i < cProp && rStream.good(); ++i)
     {
         MSOProperty aProperty;
         aProperty.Read(rStream);
         m_aProperties.push_back(aProperty);
     }
+    return rStream.good();
 }
 
 void MSOPropertyBag::Write(WW8Export& rExport)
@@ -6458,10 +6461,11 @@ void WW8SmartTagData::Read(SvStream& rStream, WW8_FC fcFactoidData, sal_uInt32 l
         return;
 
     m_aPropBagStore.Read(rStream);
-    while (rStream.Tell() < fcFactoidData + lcbFactoidData)
+    while (rStream.good() && rStream.Tell() < fcFactoidData + lcbFactoidData)
     {
         MSOPropertyBag aPropertyBag;
-        aPropertyBag.Read(rStream);
+        if (!aPropertyBag.Read(rStream))
+            break;
         m_aPropBags.push_back(aPropertyBag);
     }
 
diff --git a/sw/source/filter/ww8/ww8struc.hxx b/sw/source/filter/ww8/ww8struc.hxx
index 9eb87651695b..bddb909c85ef 100644
--- a/sw/source/filter/ww8/ww8struc.hxx
+++ b/sw/source/filter/ww8/ww8struc.hxx
@@ -1122,7 +1122,7 @@ class MSOPropertyBag
 {
 public:
     MSOPropertyBag();
-    void Read(SvStream& rStream);
+    bool Read(SvStream& rStream);
     void Write(WW8Export& rExport);
 
     /// Matches MSOFactoidType::m_nId in MSOPropertyBagStore::m_aFactoidTypes.