ofz#801 avoid oom

Change-Id: Id3167d1eb3f058543ab7596008012d51b3d242b7

3 files changed, 15 insertions, 0 deletions

diff --git a/lotuswordpro/source/filter/lwpgrfobj.cxx b/lotuswordpro/source/filter/lwpgrfobj.cxx
index 04d46160a21c..cf5cc9953e88 100644
--- a/lotuswordpro/source/filter/lwpgrfobj.cxx
+++ b/lotuswordpro/source/filter/lwpgrfobj.cxx
@@ -113,6 +113,14 @@ void LwpGraphicObject::Read()
     unsigned char *pServerContext = nullptr;
     if (nServerContextSize > 0)
     {
+        sal_uInt16 nMaxPossibleSize = m_pObjStrm->remainingSize();
+
+        if (nServerContextSize > nMaxPossibleSize)
+        {
+            SAL_WARN("lwp", "stream too short for claimed no of records");
+            nServerContextSize = nMaxPossibleSize;
+        }
+
         pServerContext = new unsigned char[nServerContextSize];
         m_pObjStrm->QuickRead(pServerContext, static_cast<sal_uInt16>(nServerContextSize));
         if (nServerContextSize > 44)
diff --git a/lotuswordpro/source/filter/lwpobjstrm.cxx b/lotuswordpro/source/filter/lwpobjstrm.cxx
index 8a28c9fd214a..072edf700dd2 100644
--- a/lotuswordpro/source/filter/lwpobjstrm.cxx
+++ b/lotuswordpro/source/filter/lwpobjstrm.cxx
@@ -155,6 +155,12 @@ void LwpObjectStream::ReleaseBuffer()
         }
     }
 }
+
+sal_uInt16 LwpObjectStream::remainingSize() const
+{
+    return m_nBufSize - m_nReadPos;
+}
+
 /**
  * @descr  read len bytes from object stream to buffer
  */
diff --git a/lotuswordpro/source/filter/lwpobjstrm.hxx b/lotuswordpro/source/filter/lwpobjstrm.hxx
index 918659da82b4..83062eebd0e8 100644
--- a/lotuswordpro/source/filter/lwpobjstrm.hxx
+++ b/lotuswordpro/source/filter/lwpobjstrm.hxx
@@ -85,6 +85,7 @@ private:
     LwpSvStream* m_pStrm;
     bool m_bCompressed;
 public:
+    sal_uInt16 remainingSize() const;
     sal_uInt16 QuickRead(void* buf, sal_uInt16 len);
     sal_uInt16 GetPos() { return m_nReadPos; }
     void SeekRel(sal_uInt16 pos);