[Libreoffice-commits] core.git: Branch 'libreoffice-7-0' - sw/source

[Caolán McNamara (via logerrit)]

 sw/source/filter/ascii/parasc.cxx |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

New commits:
commit a4f06c2498349a353c30d82eae826b36265c9599
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Oct 2 14:43:53 2020 +0100
Commit:     Michael Stahl <michael.stahl at cib.de>
CommitDate: Mon Oct 5 15:29:48 2020 +0200

    crashtesting: an odd number of bytes for RTL_TEXTENCODING_UCS2 encoding
    
    seen with id:000316,src:000190+000204,op:splice,rep:32.doc
    
    Change-Id: Ia4eb13ed617828f0d35bed26651a7b9e9a4b6056
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103796
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.stahl at cib.de>

diff --git a/sw/source/filter/ascii/parasc.cxx b/sw/source/filter/ascii/parasc.cxx
index 2cf851d0b558..162459ff1819 100644
--- a/sw/source/filter/ascii/parasc.cxx
+++ b/sw/source/filter/ascii/parasc.cxx
@@ -347,12 +347,13 @@ ErrCode SwASCIIParser::ReadChars()
             else
             {
                 pStt = pLastStt = reinterpret_cast<sal_Unicode*>(pArr.get());
-                pEnd = reinterpret_cast<sal_Unicode*>(pArr.get() + lGCount);
+                auto nChars = lGCount / 2;
+                pEnd = pStt + nChars;
 
                 if( bSwapUnicode )
                 {
                     char* pF = pArr.get(), *pN = pArr.get() + 1;
-                    for( sal_uLong n = 0; n < lGCount; n += 2, pF += 2, pN += 2 )
+                    for( sal_uLong n = 0; n < nChars; ++n, pF += 2, pN += 2 )
                     {
                         char c = *pF;
                         *pF = *pN;