ofz#25553 Infinite loop

Change-Id: Ie0ecacb69b1e99ca52abd9038baa176be8383661
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/102404
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>

5 files changed, 28 insertions, 28 deletions

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index ba974091c481..31e26eb7e0a7 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -6574,13 +6574,13 @@ bool SwMSDffManager::GetOLEStorageName(sal_uInt32 nOLEId, OUString& rStorageName
 
                     if (aDesc.nSprmsLen && aDesc.pMemPos) // Attributes present
                     {
-                        long nLen = aDesc.nSprmsLen;
+                        auto nLen = aDesc.nSprmsLen;
                         const sal_uInt8* pSprm = aDesc.pMemPos;
 
                         while (nLen >= 2 && !nPictureId)
                         {
                             sal_uInt16 nId = aSprmParser.GetSprmId(pSprm);
-                            sal_uInt16 nSL = aSprmParser.GetSprmSize(nId, pSprm, nLen);
+                            sal_Int32 nSL = aSprmParser.GetSprmSize(nId, pSprm, nLen);
 
                             if( nLen < nSL )
                                 break; // Not enough Bytes left
diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index 6f8f7a49fc8c..292de278ff14 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -1842,9 +1842,9 @@ WW8TabDesc::WW8TabDesc(SwWW8ImplReader* pIoClass, WW8_CP nStartCp) :
             while (aSprmIter.GetSprms() && nullptr != (pParams = aSprmIter.GetCurrentParams()))
             {
                 sal_uInt16 nId = aSprmIter.GetCurrentId();
-                sal_uInt16 nFixedLen = aSprmParser.DistanceToData(nId);
-                sal_uInt16 nL = aSprmParser.GetSprmSize(nId, aSprmIter.GetSprms(), aSprmIter.GetRemLen());
-                sal_uInt16 nLen = nL - nFixedLen;
+                sal_Int32 nFixedLen = aSprmParser.DistanceToData(nId);
+                sal_Int32 nL = aSprmParser.GetSprmSize(nId, aSprmIter.GetSprms(), aSprmIter.GetRemLen());
+                sal_Int32 nLen = nL - nFixedLen;
                 wwTableSprm eSprm = GetTableSprm(nId, m_pIo->GetFib().GetFIBVersion());
                 switch (eSprm)
                 {
diff --git a/sw/source/filter/ww8/ww8par6.cxx b/sw/source/filter/ww8/ww8par6.cxx
index b546cb0ac79c..8d7edf6ac1c8 100644
--- a/sw/source/filter/ww8/ww8par6.cxx
+++ b/sw/source/filter/ww8/ww8par6.cxx
@@ -6103,8 +6103,8 @@ short SwWW8ImplReader::ImportSprm(const sal_uInt8* pPos, sal_Int32 nMemLen, sal_
 
     const SprmReadInfo& rSprm = GetSprmReadInfo(nId);
 
-    sal_uInt16 nFixedLen = m_xSprmParser->DistanceToData(nId);
-    sal_uInt16 nL = m_xSprmParser->GetSprmSize(nId, pPos, nMemLen);
+    sal_Int32 nFixedLen = m_xSprmParser->DistanceToData(nId);
+    sal_Int32 nL = m_xSprmParser->GetSprmSize(nId, pPos, nMemLen);
 
     if (rSprm.pReadFnc)
         (this->*rSprm.pReadFnc)(nId, pPos + nFixedLen, nL - nFixedLen);
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 3efefc1067e5..dfa8fe9d4a5e 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -928,8 +928,8 @@ SprmResult WW8SprmIter::FindSprm(sal_uInt16 nId, bool bFindFirst, const sal_uInt
     {
         if (GetCurrentId() == nId)
         {
-            sal_uInt16 nFixedLen =  mrSprmParser.DistanceToData(nId);
-            sal_uInt16 nL = mrSprmParser.GetSprmSize(nId, GetSprms(), GetRemLen());
+            sal_Int32 nFixedLen =  mrSprmParser.DistanceToData(nId);
+            sal_Int32 nL = mrSprmParser.GetSprmSize(nId, GetSprms(), GetRemLen());
             SprmResult aSprmResult(GetCurrentParams(), nL - nFixedLen);
             // typically pNextByteMatch is nullptr and we just return the first match
             // very occasionally we want one with a specific following byte
@@ -2981,8 +2981,8 @@ void WW8PLCFx_Fc_FKP::WW8Fkp::HasSprm(sal_uInt16 nId,
     {
         if (aIter.GetCurrentId() == nId)
         {
-            sal_uInt16 nFixedLen = maSprmParser.DistanceToData(nId);
-            sal_uInt16 nL = maSprmParser.GetSprmSize(nId, aIter.GetSprms(), aIter.GetRemLen());
+            sal_Int32 nFixedLen = maSprmParser.DistanceToData(nId);
+            sal_Int32 nL = maSprmParser.GetSprmSize(nId, aIter.GetSprms(), aIter.GetRemLen());
             rResult.emplace_back(aIter.GetCurrentParams(), nL - nFixedLen);
         }
         aIter.advance();
@@ -3314,8 +3314,8 @@ void WW8PLCFx_Fc_FKP::HasSprm(sal_uInt16 nId, std::vector<SprmResult> &rResult)
     {
         if (aIter.GetCurrentId() == nId)
         {
-            sal_uInt16 nFixedLen = rSprmParser.DistanceToData(nId);
-            sal_uInt16 nL = rSprmParser.GetSprmSize(nId, aIter.GetSprms(), aIter.GetRemLen());
+            sal_Int32 nFixedLen = rSprmParser.DistanceToData(nId);
+            sal_Int32 nL = rSprmParser.GetSprmSize(nId, aIter.GetSprms(), aIter.GetRemLen());
             rResult.emplace_back(aIter.GetCurrentParams(), nL - nFixedLen);
         }
         aIter.advance();
@@ -3811,7 +3811,7 @@ bool WW8PLCFx_SEPX::Find4Sprms(sal_uInt16 nId1,sal_uInt16 nId2,sal_uInt16 nId3,s
         // Sprm found?
         const sal_uInt16 nCurrentId = maSprmParser.GetSprmId(pSp);
         sal_Int32 nRemLen = nSprmSiz - i;
-        const sal_uInt16 x = maSprmParser.GetSprmSize(nCurrentId, pSp, nRemLen);
+        const sal_Int32 x = maSprmParser.GetSprmSize(nCurrentId, pSp, nRemLen);
         bool bValid = x <= nRemLen;
         if (!bValid)
         {
@@ -3821,22 +3821,22 @@ bool WW8PLCFx_SEPX::Find4Sprms(sal_uInt16 nId1,sal_uInt16 nId2,sal_uInt16 nId3,s
         bool bOk = true;
         if( nCurrentId  == nId1 )
         {
-            sal_uInt16 nFixedLen = maSprmParser.DistanceToData(nId1);
+            sal_Int32 nFixedLen = maSprmParser.DistanceToData(nId1);
             r1 = SprmResult(pSp + nFixedLen, x - nFixedLen);
         }
         else if( nCurrentId  == nId2 )
         {
-            sal_uInt16 nFixedLen = maSprmParser.DistanceToData(nId2);
+            sal_Int32 nFixedLen = maSprmParser.DistanceToData(nId2);
             r2 = SprmResult(pSp + nFixedLen, x - nFixedLen);
         }
         else if( nCurrentId  == nId3 )
         {
-            sal_uInt16 nFixedLen = maSprmParser.DistanceToData(nId3);
+            sal_Int32 nFixedLen = maSprmParser.DistanceToData(nId3);
             r3 = SprmResult(pSp + nFixedLen, x - nFixedLen);
         }
         else if( nCurrentId  == nId4 )
         {
-            sal_uInt16 nFixedLen = maSprmParser.DistanceToData(nId4);
+            sal_Int32 nFixedLen = maSprmParser.DistanceToData(nId4);
             r4 = SprmResult(pSp + nFixedLen, x - nFixedLen);
         }
         else
@@ -5303,7 +5303,7 @@ void WW8PLCFMan::AdvSprm(short nIdx, bool bStart)
             if( p->pMemPos )
             {
                 // Length of last sprm
-                const sal_uInt16 nSprmL = maSprmParser.GetSprmSize(nLastId, p->pMemPos, p->nSprmsLen);
+                const sal_Int32 nSprmL = maSprmParser.GetSprmSize(nLastId, p->pMemPos, p->nSprmsLen);
 
                 // Reduce length of all sprms by length of last sprm
                 p->nSprmsLen -= nSprmL;
@@ -8407,7 +8407,7 @@ sal_uInt16 wwSprmParser::GetSprmId(const sal_uInt8* pSp) const
 }
 
 // with tokens and length byte
-sal_uInt16 wwSprmParser::GetSprmSize(sal_uInt16 nId, const sal_uInt8* pSprm, sal_Int32 nRemLen) const
+sal_Int32 wwSprmParser::GetSprmSize(sal_uInt16 nId, const sal_uInt8* pSprm, sal_Int32 nRemLen) const
 {
     return GetSprmTailLen(nId, pSprm, nRemLen) + 1 + mnDelta + SprmDataOfs(nId);
 }
@@ -8417,19 +8417,19 @@ sal_uInt8 wwSprmParser::SprmDataOfs(sal_uInt16 nId) const
     return GetSprmInfo(nId).nVari;
 }
 
-sal_uInt16 wwSprmParser::DistanceToData(sal_uInt16 nId) const
+sal_Int32 wwSprmParser::DistanceToData(sal_uInt16 nId) const
 {
     return 1 + mnDelta + SprmDataOfs(nId);
 }
 
 SprmResult wwSprmParser::findSprmData(sal_uInt16 nId, sal_uInt8* pSprms,
-    sal_uInt16 nLen) const
+    sal_Int32 nLen) const
 {
     while (nLen >= MinSprmLen())
     {
         const sal_uInt16 nCurrentId = GetSprmId(pSprms);
         // set pointer to data
-        sal_uInt16 nSize = GetSprmSize(nCurrentId, pSprms, nLen);
+        sal_Int32 nSize = GetSprmSize(nCurrentId, pSprms, nLen);
 
         bool bValid = nSize <= nLen;
 
@@ -8439,7 +8439,7 @@ SprmResult wwSprmParser::findSprmData(sal_uInt16 nId, sal_uInt8* pSprms,
 
         if (nCurrentId == nId && bValid) // Sprm found
         {
-            sal_uInt16 nFixedLen = DistanceToData(nId);
+            sal_Int32 nFixedLen = DistanceToData(nId);
             return SprmResult(pSprms + nFixedLen, nSize - nFixedLen);
         }
 
diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx
index 85f080e4bebc..0b606d316e95 100644
--- a/sw/source/filter/ww8/ww8scan.hxx
+++ b/sw/source/filter/ww8/ww8scan.hxx
@@ -131,11 +131,11 @@ public:
     /// Return the SPRM id at the beginning of this byte sequence
     sal_uInt16 GetSprmId(const sal_uInt8* pSp) const;
 
-    sal_uInt16 GetSprmSize(sal_uInt16 nId, const sal_uInt8* pSprm, sal_Int32 nRemLen) const;
+    sal_Int32 GetSprmSize(sal_uInt16 nId, const sal_uInt8* pSprm, sal_Int32 nRemLen) const;
 
     /// Get known len of a sprms head, the bytes of the sprm id + any bytes
     /// reserved to hold a variable length
-    sal_uInt16 DistanceToData(sal_uInt16 nId) const;
+    sal_Int32 DistanceToData(sal_uInt16 nId) const;
 
     /// Get len of a sprms data area, ignoring the bytes of the sprm id and
     /// ignoring any len bytes. Reports the remaining data after those bytes
@@ -146,7 +146,7 @@ public:
 
     /// Returns the offset to data of the first sprm of id nId, 0
     //  if not found. nLen must be the <= length of pSprms
-    SprmResult findSprmData(sal_uInt16 nId, sal_uInt8* pSprms, sal_uInt16 nLen) const;
+    SprmResult findSprmData(sal_uInt16 nId, sal_uInt8* pSprms, sal_Int32 nLen) const;
 };
 
 //Read a Pascal-style, i.e. single byte string length followed
@@ -264,7 +264,7 @@ private:
     const sal_uInt8* pSprms; // remaining part of the SPRMs ( == start of current SPRM)
     const sal_uInt8* pCurrentParams; // start of current SPRM's parameters
     sal_uInt16 nCurrentId;
-    sal_uInt16 nCurrentSize;
+    sal_Int32 nCurrentSize;
 
     sal_Int32 nRemLen;   // length of remaining SPRMs (including current SPRM)