[Libreoffice-commits] core.git: svtools/source

[Caolán McNamara]

 svtools/source/svrtf/parrtf.cxx |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

New commits:
commit b3f1d199a72ce87cb65ddaeac922564f57da6a4d
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Nov 5 19:16:31 2017 +0000

    ofz infinite loop
    
    Change-Id: I9eab92f72618a062455e9e17d9a262f28d8bb740
    Reviewed-on: https://gerrit.libreoffice.org/44332
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/svtools/source/svrtf/parrtf.cxx b/svtools/source/svrtf/parrtf.cxx
index 7ef29c77e289..cd2b4537c0dc 100644
--- a/svtools/source/svrtf/parrtf.cxx
+++ b/svtools/source/svrtf/parrtf.cxx
@@ -305,7 +305,7 @@ sal_Unicode SvRTFParser::GetHexValue()
 
 void SvRTFParser::ScanText()
 {
-     const sal_Unicode cBreak = 0;
+    const sal_Unicode cBreak = 0;
     OUStringBuffer aStrBuffer;
     bool bContinue = true;
     while( bContinue && IsParserWorking() && aStrBuffer.getLength() < MAX_STRING_LEN)
@@ -333,12 +333,16 @@ void SvRTFParser::ScanText()
                             aByteString.append(c);
 
                             bool bBreak = false;
+                            bool bEOF = false;
                             sal_Char nSlash = '\\';
                             while (!bBreak)
                             {
                                 auto next = GetNextChar();
                                 if (sal_Unicode(EOF) == next)
+                                {
+                                    bEOF = true;
                                     break;
+                                }
                                 if (next>0xFF) // fix for #i43933# and #i35653#
                                 {
                                     if (!aByteString.isEmpty())
@@ -364,6 +368,12 @@ void SvRTFParser::ScanText()
                                 }
                             }
 
+                            if (bEOF)
+                            {
+                                bContinue = false;        // abort, string together
+                                break;
+                            }
+
                             nNextCh = GetNextChar();
 
                             if (nSlash != '\\' || nNextCh != '\'')