diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-09-21 12:18:22 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-09-21 14:55:22 +0200 |
| commit | 3a807c6d6176caaec83654204a2cca41e1be28ea (patch) | |
| tree | 779d1133c7e939976a62290206d79adfa25c3786 | |
| parent | 360d504464f68c031359026b15ccce38e797f220 (diff) | |
ofz#10523 infinite .doc parse recursion
Change-Id: Ie39ce942bbfe724e0f9c7be6bafaf3fdc607f19d
Reviewed-on: https://gerrit.libreoffice.org/60868
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | sw/source/filter/ww8/ww8par.cxx | 10 | ||||
| -rw-r--r-- | sw/source/filter/ww8/ww8par.hxx | 2 |
2 files changed, 9 insertions, 3 deletions
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx index 90cda2ccec3d..c603f48ed669 100644 --- a/sw/source/filter/ww8/ww8par.cxx +++ b/sw/source/filter/ww8/ww8par.cxx @@ -3758,7 +3758,7 @@ void SwWW8ImplReader::ProcessCurrentCollChange(WW8PLCFManResult& rRes, } } -long SwWW8ImplReader::ReadTextAttr(WW8_CP& rTextPos, long nTextEnd, bool& rbStartLine) +long SwWW8ImplReader::ReadTextAttr(WW8_CP& rTextPos, long nTextEnd, bool& rbStartLine, int nDepthGuard) { long nSkipChars = 0; WW8PLCFManResult aRes; @@ -3850,7 +3850,13 @@ long SwWW8ImplReader::ReadTextAttr(WW8_CP& rTextPos, long nTextEnd, bool& rbStar if( (0 <= nNext) && (nSkipPos >= nNext) ) { - nNext = ReadTextAttr(rTextPos, nTextEnd, rbStartLine); + if (nDepthGuard >= 1024) + { + SAL_WARN("sw.ww8", "ReadTextAttr hit recursion limit"); + nNext = nTextEnd; + } + else + nNext = ReadTextAttr(rTextPos, nTextEnd, rbStartLine, nDepthGuard + 1); bDoPlcxManPlusPLus = false; m_bIgnoreText = true; } diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx index af64878ddc14..74fbfcecec31 100644 --- a/sw/source/filter/ww8/ww8par.hxx +++ b/sw/source/filter/ww8/ww8par.hxx @@ -1421,7 +1421,7 @@ private: void ProcessCurrentCollChange(WW8PLCFManResult& rRes, bool* pStartAttr, bool bCallProcessSpecial); - long ReadTextAttr(WW8_CP& rTextPos, long nTextEnd, bool& rbStartLine); + long ReadTextAttr(WW8_CP& rTextPos, long nTextEnd, bool& rbStartLine, int nDepthGuard = 0); void ReadAttrs(WW8_CP& rTextPos, WW8_CP& rNext, long nTextEnd, bool& rbStartLine); void CloseAttrEnds(); bool ReadText(WW8_CP nStartCp, WW8_CP nTextLen, ManTypes nType); |