Resolves: tdf#121200 better ofz#7802 infinite loop fix

Change-Id: I50163d6545782012b177a48a1aded0572499f9af
Reviewed-on: https://gerrit.libreoffice.org/63097
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 17 insertions, 1 deletions

diff --git a/editeng/source/rtf/svxrtf.cxx b/editeng/source/rtf/svxrtf.cxx
index 6f8299e0716e..eed91b25158f 100644
--- a/editeng/source/rtf/svxrtf.cxx
+++ b/editeng/source/rtf/svxrtf.cxx
@@ -352,18 +352,34 @@ void SvxRTFParser::ReadStyleTable()
             case RTF_CHRFMT:
             case RTF_BRDRDEF:
             case RTF_TABSTOPDEF:
-
+#ifndef NDEBUG
+                auto nEnteringToken = nToken;
+#endif
+                auto nEnteringIndex = m_nTokenIndex;
+                int nSkippedTokens = 0;
                 if( RTF_SWGDEFS & nToken)
                 {
                     if( RTF_IGNOREFLAG != GetStackPtr( -1 )->nTokenId )
                         break;
                     nToken = SkipToken();
+                    ++nSkippedTokens;
                     if( '{' == GetStackPtr( -1 )->nTokenId )
                     {
                         nToken = SkipToken();
+                        ++nSkippedTokens;
                     }
                 }
                 ReadAttr( nToken, &pStyle->aAttrSet );
+                if (nSkippedTokens && m_nTokenIndex == nEnteringIndex - nSkippedTokens)
+                {
+                    // we called SkipToken to go back one or two, but ReadAttrs
+                    // read nothing, so on next loop of the outer while we
+                    // would end up in the same state again (assert that)
+                    assert(nEnteringToken == GetNextToken());
+                    // and loop endlessly, skip format a token
+                    // instead to avoid that
+                    SkipToken(nSkippedTokens);
+                }
                 break;
             }
             break;