[Libreoffice-commits] core.git: sw/source

[Libreoffice Gerrit user]

 sw/source/filter/ww8/ww8par.cxx |   10 ++++++++--
 sw/source/filter/ww8/ww8par.hxx |    2 +-
 2 files changed, 9 insertions(+), 3 deletions(-)

New commits:
commit 3a807c6d6176caaec83654204a2cca41e1be28ea
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Sep 21 12:18:22 2018 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Fri Sep 21 14:55:22 2018 +0200

    ofz#10523 infinite .doc parse recursion
    
    Change-Id: Ie39ce942bbfe724e0f9c7be6bafaf3fdc607f19d
    Reviewed-on: https://gerrit.libreoffice.org/60868
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 90cda2ccec3d..c603f48ed669 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -3758,7 +3758,7 @@ void SwWW8ImplReader::ProcessCurrentCollChange(WW8PLCFManResult& rRes,
     }
 }
 
-long SwWW8ImplReader::ReadTextAttr(WW8_CP& rTextPos, long nTextEnd, bool& rbStartLine)
+long SwWW8ImplReader::ReadTextAttr(WW8_CP& rTextPos, long nTextEnd, bool& rbStartLine, int nDepthGuard)
 {
     long nSkipChars = 0;
     WW8PLCFManResult aRes;
@@ -3850,7 +3850,13 @@ long SwWW8ImplReader::ReadTextAttr(WW8_CP& rTextPos, long nTextEnd, bool& rbStar
 
         if( (0 <= nNext) && (nSkipPos >= nNext) )
         {
-            nNext = ReadTextAttr(rTextPos, nTextEnd, rbStartLine);
+            if (nDepthGuard >= 1024)
+            {
+                SAL_WARN("sw.ww8", "ReadTextAttr hit recursion limit");
+                nNext = nTextEnd;
+            }
+            else
+                nNext = ReadTextAttr(rTextPos, nTextEnd, rbStartLine, nDepthGuard + 1);
             bDoPlcxManPlusPLus = false;
             m_bIgnoreText = true;
         }
diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index af64878ddc14..74fbfcecec31 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -1421,7 +1421,7 @@ private:
 
     void ProcessCurrentCollChange(WW8PLCFManResult& rRes, bool* pStartAttr,
         bool bCallProcessSpecial);
-    long ReadTextAttr(WW8_CP& rTextPos, long nTextEnd, bool& rbStartLine);
+    long ReadTextAttr(WW8_CP& rTextPos, long nTextEnd, bool& rbStartLine, int nDepthGuard = 0);
     void ReadAttrs(WW8_CP& rTextPos, WW8_CP& rNext, long nTextEnd, bool& rbStartLine);
     void CloseAttrEnds();
     bool ReadText(WW8_CP nStartCp, WW8_CP nTextLen, ManTypes nType);