diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-04-03 21:22:00 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-04-23 14:06:47 +0200 |
| commit | 74a1987c81059fa5e37c2c12144c583e3f3dd95e (patch) | |
| tree | 33c34a3c4060c83f92f46982cc6ca5b39f535205 | |
| parent | 205d6bdeb41e1ca944d5a63d25ef768ce52978e9 (diff) | |
ofz: check anldPap sprm for valid ANLD payload len
Change-Id: Ie034e3b37e01c29cf19fe8ad78b1121f6eadecb2
Reviewed-on: https://gerrit.libreoffice.org/36053
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 29cf858a971273039fff50808082f231dbd43c92)
Reviewed-on: https://gerrit.libreoffice.org/36076
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit d9d8631d7c0142e2ddd0bec1f986cb20f339d639)
| -rw-r--r-- | sw/source/filter/ww8/ww8par2.cxx | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx index bc03e3130c03..06ddb8a6f60a 100644 --- a/sw/source/filter/ww8/ww8par2.cxx +++ b/sw/source/filter/ww8/ww8par2.cxx @@ -879,6 +879,13 @@ void SwWW8ImplReader::Read_ANLevelDesc( sal_uInt16, const sal_uInt8* pData, shor return; } + if (static_cast<size_t>(nLen) < sizeof(WW8_ANLD)) + { + SAL_WARN("sw.ww8", "ANLevelDesc property is " << nLen << " long, needs to be at least " << sizeof(WW8_ANLD)); + m_nSwNumLevel = 0xff; + return; + } + if( m_nSwNumLevel <= MAXLEVEL // Value range mapping WW:1..9 -> SW:0..8 && m_nSwNumLevel <= 9 ){ // No Bullets or Numbering |