[ooo-build-commit] Branch 'ooo/OOO320' - sw/source

[Jan Holesovsky]

 sw/source/filter/ww8/ww8par2.cxx |   19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

New commits:
commit d13b49038fb283b6a2a16cd188b9b5732caf4afe
Author: Ivo Hinkelmann <ihi at openoffice.org>
Date:   Fri Nov 20 15:53:13 2009 +0000

    CWS-TOOLING: integrate CWS hb32showstoppers3
    2009-11-11 16:00:58 +0100 hbrinkm  r277463 : #b6898803# WW8TabBandDesc::ProcessSprmTSetBRC: check bounds
    2009-11-09 13:48:11 +0100 hbrinkm  r277409 : #b6898803# ensure to read only as many TCs as are there

diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index 635a2b7..b737fc1 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -1170,6 +1170,7 @@ void WW8TabBandDesc::ReadDef(bool bVer67, const BYTE* pS)
         pS++;
 
     short nLen = (INT16)SVBT16ToShort( pS - 2 ); // nicht schoen
+
     BYTE nCols = *pS;                       // Anzahl der Zellen
     short nOldCols = nWwCols;
 
@@ -1200,7 +1201,11 @@ void WW8TabBandDesc::ReadDef(bool bVer67, const BYTE* pS)
         setcelldefaults(pTCs,nCols);
     }
 
-    if( nFileCols )
+    short nColsToRead = nFileCols;
+    if (nColsToRead > nCols)
+        nColsToRead = nCols;
+
+    if( nColsToRead )
     {
         // lies TCs ein
 
@@ -1216,9 +1221,9 @@ void WW8TabBandDesc::ReadDef(bool bVer67, const BYTE* pS)
         if( bVer67 )
         {
             WW8_TCellVer6* pTc = (WW8_TCellVer6*)pT;
-            for(i=0; i<nFileCols; i++, ++pAktTC,++pTc)
+            for(i=0; i<nColsToRead; i++, ++pAktTC,++pTc)
             {
-                if( i < nFileCols )
+                if( i < nColsToRead )
                 {               // TC aus File ?
                     BYTE aBits1 = SVBT8ToByte( pTc->aBits1Ver6 );
                     pAktTC->bFirstMerged    = ( ( aBits1 & 0x01 ) != 0 );
@@ -1248,7 +1253,7 @@ void WW8TabBandDesc::ReadDef(bool bVer67, const BYTE* pS)
         else
         {
             WW8_TCellVer8* pTc = (WW8_TCellVer8*)pT;
-            for (int k = 0; k < nFileCols; ++k, ++pAktTC, ++pTc )
+            for (int k = 0; k < nColsToRead; ++k, ++pAktTC, ++pTc )
             {
                 UINT16 aBits1 = SVBT16ToShort( pTc->aBits1Ver8 );
                 pAktTC->bFirstMerged    = ( ( aBits1 & 0x0001 ) != 0 );
@@ -1296,6 +1301,12 @@ void WW8TabBandDesc::ProcessSprmTSetBRC(bool bVer67, const BYTE* pParamsTSetBRC)
         BYTE nitcLim  = pParamsTSetBRC[1];// (last col to be changed)+1
         BYTE nFlag    = *(pParamsTSetBRC+2);
 
+        if (nitcFirst >= nWwCols)
+            return;
+
+        if (nitcLim > nWwCols)
+            nitcLim = nWwCols;
+
         bool bChangeRight  = (nFlag & 0x08) ? true : false;
         bool bChangeBottom = (nFlag & 0x04) ? true : false;
         bool bChangeLeft   = (nFlag & 0x02) ? true : false;