[Libreoffice-commits] core.git: lotuswordpro/Library_lwpft.mk lotuswordpro/source

[Caolán McNamara (via logerrit)]

 lotuswordpro/Library_lwpft.mk                |    1 +
 lotuswordpro/source/filter/lwpcelllayout.cxx |    6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

New commits:
commit 637068510682ec0cf63227d2f81bdcfc6598c7e6
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Sep 8 14:40:05 2021 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Wed Sep 8 17:09:30 2021 +0200

    ofz#27296 limit row span when fuzzing
    
    Change-Id: I3069875f64acaf394cfef7f6478abc974022d536
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/121819
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/lotuswordpro/Library_lwpft.mk b/lotuswordpro/Library_lwpft.mk
index 5965b385e1bc..af0f940cc666 100644
--- a/lotuswordpro/Library_lwpft.mk
+++ b/lotuswordpro/Library_lwpft.mk
@@ -32,6 +32,7 @@ $(eval $(call gb_Library_use_libraries,lwpft,\
     svxcore \
     tl \
     ucbhelper \
+    utl \
     vcl \
     xo \
 ))
diff --git a/lotuswordpro/source/filter/lwpcelllayout.cxx b/lotuswordpro/source/filter/lwpcelllayout.cxx
index 71d0bce8a943..ef39c4ae1009 100644
--- a/lotuswordpro/source/filter/lwpcelllayout.cxx
+++ b/lotuswordpro/source/filter/lwpcelllayout.cxx
@@ -67,6 +67,7 @@
 #include <lwpglobalmgr.hxx>
 
 #include <sal/log.hxx>
+#include <unotools/configmgr.hxx>
 
 #include <xfilter/xfstylemanager.hxx>
 #include <xfilter/xfcell.hxx>
@@ -813,13 +814,14 @@ LwpCellBorderType LwpConnectedCellLayout::GetCellBorderType(sal_uInt16 nRow, sal
 void LwpConnectedCellLayout::Read()
 {
     LwpCellLayout::Read();
-    sal_uInt16 numcols;
 
     cnumrows = m_pObjStrm->QuickReaduInt16();
-    numcols = m_pObjStrm->QuickReaduInt16();        // written as a lushort
+    sal_uInt16 numcols = m_pObjStrm->QuickReaduInt16();        // written as a lushort
     cnumcols = static_cast<sal_uInt8>(numcols);
 
     m_nRealrowspan = cnumrows;
+    if (utl::ConfigManager::IsFuzzing())
+        m_nRealrowspan = std::min<sal_uInt16>(m_nRealrowspan, SAL_MAX_INT16);
     m_nRealcolspan = cnumcols;
 
     m_pObjStrm->SkipExtra();