[Libreoffice-commits] core.git: sw/source

[Caolán McNamara (via logerrit)]

 sw/source/filter/ww8/ww8par3.cxx |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

New commits:
commit d8e76fff830e310616c92156547cca00bce8e74d
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Apr 24 11:59:56 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Wed Apr 24 14:53:24 2019 +0200

    crashtesting: imported junk as form field text
    
    spec says "An unsigned integer that MUST be 0xFFFFFFFF" for version
    so at least insist on that
    
    Change-Id: I8c11659d86fe122b1c8f61b1bf99e7b4b53ff306
    Reviewed-on: https://gerrit.libreoffice.org/71227
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index 9724fbffb0cd..829011373542 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -2124,13 +2124,17 @@ void WW8FormulaControl::FormulaRead(SwWw8ControlType nWhich,
     SvStream *pDataStream)
 {
     sal_uInt8 nField;
-    // nHeaderBype == version
-    sal_uInt32 nHeaderByte = 0;
 
     // The following is a FFData structure as described in
     // Microsoft's DOC specification (chapter 2.9.78)
-
-    pDataStream->ReadUInt32( nHeaderByte );
+    sal_uInt32 nVersion = 0;
+    pDataStream->ReadUInt32(nVersion);
+    // An unsigned integer that MUST be 0xFFFFFFFF
+    if (nVersion != 0xFFFFFFFF)
+    {
+        SAL_WARN("sw.ww8", "Parsing error: invalid header for FFData");
+        return; // bail out
+    }
 
     // might be better to read the bits as a 16 bit word
     // ( like it is in the spec. )