guard against hangs with bogus unsorted plcfs

Change-Id: I91caff583617435add76503498ca4ed361eb5d2e

3 files changed, 18 insertions, 0 deletions

diff --git a/sw/qa/core/data/ww5/pass/hang-1.doc b/sw/qa/core/data/ww5/pass/hang-1.doc
new file mode 100644
index 000000000000..603372406e18
--- /dev/null
+++ b/sw/qa/core/data/ww5/pass/hang-1.doc
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 313dd7833858..05e2be942698 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2101,6 +2101,8 @@ void WW8PLCF::ReadPLCF(SvStream& rSt, WW8_FC nFilePos, sal_uInt32 nPLCF)
 #endif // OSL_BIGENDIAN
         // Pointer to content array
         pPLCF_Contents = reinterpret_cast<sal_uInt8*>(&pPLCF_PosArray[nIMax + 1]);
+
+        TruncToSortedRange();
     }
 
     OSL_ENSURE(bValid, "Document has corrupt PLCF, ignoring it");
@@ -2120,6 +2122,21 @@ void WW8PLCF::MakeFailedPLCF()
     pPLCF_Contents = reinterpret_cast<sal_uInt8*>(&pPLCF_PosArray[nIMax + 1]);
 }
 
+void WW8PLCF::TruncToSortedRange()
+{
+    //Docs state that: ... all Plcs ... are sorted in ascending order.
+    //So ensure that here for broken documents.
+    for (auto nI = 0; nI < nIMax; ++nI)
+    {
+        if (pPLCF_PosArray[nI] >= pPLCF_PosArray[nI+1])
+        {
+            SAL_WARN("sw.ww8", "Document has unsorted PLCF, truncated to sorted portion");
+            nIMax = nI;
+            break;
+        }
+    }
+}
+
 void WW8PLCF::GeneratePLCF(SvStream& rSt, sal_Int32 nPN, sal_Int32 ncpN)
 {
     OSL_ENSURE( nIMax < ncpN, "Pcl.Fkp: Why is PLCF too big?" );
diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx
index 53e5d47c507b..54e8165251f6 100644
--- a/sw/source/filter/ww8/ww8scan.hxx
+++ b/sw/source/filter/ww8/ww8scan.hxx
@@ -291,6 +291,7 @@ private:
 
     void MakeFailedPLCF();
 
+    void TruncToSortedRange();
 public:
     WW8PLCF(SvStream& rSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
         WW8_CP nStartPos = -1);