UBSan: Restrict BorderWidthType values to valid range on input

...lotuswordpro/qa/cppunit/data/fail/null-1.lwp would read 15 into m_eBelowType

Change-Id: Icedcb4c8e2e6309b2e1bd82025feb02bad1ab7da

1 files changed, 19 insertions, 4 deletions

diff --git a/lotuswordpro/source/filter/lwpparaborderoverride.cxx b/lotuswordpro/source/filter/lwpparaborderoverride.cxx
index 67398f17d32b..7f0873a13125 100644
--- a/lotuswordpro/source/filter/lwpparaborderoverride.cxx
+++ b/lotuswordpro/source/filter/lwpparaborderoverride.cxx
@@ -124,6 +124,21 @@ LwpParaBorderOverride* LwpParaBorderOverride::clone() const
     return new LwpParaBorderOverride(*this);
 }
 
+namespace {
+
+LwpParaBorderOverride::BorderWidthType readBorderWidthType(
+    LwpObjectStream * stream)
+{
+    sal_uInt16 n = stream->QuickReaduInt16();
+    if (n > LwpParaBorderOverride::PB_CUSTOMWIDTH) {
+        SAL_WARN("lwp", "bad BorderWidthType " << n);
+        n = LwpParaBorderOverride::PB_NONE;
+    }
+    return static_cast<LwpParaBorderOverride::BorderWidthType>(n);
+}
+
+}
+
 void LwpParaBorderOverride::Read(LwpObjectStream *pStrm)
 {
     if (pStrm->QuickReadBool())
@@ -134,15 +149,15 @@ void LwpParaBorderOverride::Read(LwpObjectStream *pStrm)
         m_pShadow->Read(pStrm);
         m_pMargins->Read(pStrm);
 
-        m_eAboveType = static_cast<BorderWidthType>(pStrm->QuickReaduInt16());
-        m_eBelowType = static_cast<BorderWidthType>(pStrm->QuickReaduInt16());
-        m_eRightType = static_cast<BorderWidthType>(pStrm->QuickReaduInt16());
+        m_eAboveType = readBorderWidthType(pStrm);
+        m_eBelowType = readBorderWidthType(pStrm);
+        m_eRightType = readBorderWidthType(pStrm);
 
         if( pStrm->CheckExtra() )
         {
             m_pBetweenStuff->Read(pStrm);
 
-            m_eBetweenType = static_cast<BorderWidthType>(pStrm->QuickReaduInt16());
+            m_eBetweenType = readBorderWidthType(pStrm);
             m_nBetweenWidth = pStrm->QuickReaduInt32();
             m_nBetweenMargin = pStrm->QuickReaduInt32();