[Libreoffice-commits] core.git: editeng/source

[Caolán McNamara]

 editeng/source/rtf/svxrtf.cxx |   16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

New commits:
commit 409441652af3df62e742b9d7a3d80cb6b15214af
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue May 15 15:10:43 2018 +0100

    ofz#7802 infinite loop
    
    Change-Id: I1b631dec998efb4a689ef13ea29bcff89cf7a47f
    Reviewed-on: https://gerrit.libreoffice.org/54377
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/editeng/source/rtf/svxrtf.cxx b/editeng/source/rtf/svxrtf.cxx
index 369995b1d293..88a3a1c110bf 100644
--- a/editeng/source/rtf/svxrtf.cxx
+++ b/editeng/source/rtf/svxrtf.cxx
@@ -356,7 +356,10 @@ void SvxRTFParser::ReadStyleTable()
             case RTF_CHRFMT:
             case RTF_BRDRDEF:
             case RTF_TABSTOPDEF:
-
+#ifndef NDEBUG
+                auto nEnteringToken = nToken;
+#endif
+                auto nEnteringIndex = m_nTokenIndex;
                 if( RTF_SWGDEFS & nToken)
                 {
                     if( RTF_IGNOREFLAG != GetStackPtr( -1 )->nTokenId )
@@ -368,6 +371,17 @@ void SvxRTFParser::ReadStyleTable()
                     }
                 }
                 ReadAttr( nToken, &pStyle->aAttrSet );
+                if (m_nTokenIndex == nEnteringIndex - 1)
+                {
+                    // we called SkipToken to go back one, but
+                    // ReadAttrs read nothing, so on next loop
+                    // of outer while we would end up in the
+                    // same state again (assert that)
+                    assert(nEnteringToken == GetNextToken());
+                    // and loop endlessly, skip format a token
+                    // instead to avoid that
+                    SkipToken(1);
+                }
                 break;
             }
             break;