coverity#736209: Out-of-bounds access

Change-Id: Idd0b5bb68bd0038473f981bb03aab63a5defd3b7

2 files changed, 19 insertions, 3 deletions

diff --git a/sw/source/filter/ww8/writerhelper.hxx b/sw/source/filter/ww8/writerhelper.hxx
index ef3738695690..d15f2b8debb8 100644
--- a/sw/source/filter/ww8/writerhelper.hxx
+++ b/sw/source/filter/ww8/writerhelper.hxx
@@ -665,10 +665,26 @@ namespace sw
         */
         const SwNumFmt* GetNumFmtFromTxtNode(const SwTxtNode &rTxtNode);
 
+        /** Get the Numbering Format for a given level from a numbering rule
+
+            @param rRule
+            The numbering rule
+
+            @param nLevel
+            The numbering level
+
+            @return A SwNumFmt pointer that describes the numbering level
+            or 0 if the nLevel is out of range
+
+            @author
+            <a href="mailto:cmc@openoffice.org">Caol&aacute;n McNamara</a>
+        */
+        const SwNumFmt* GetNumFmtFromSwNumRuleLevel(const SwNumRule &rRule,
+            int nLevel);
+
         const SwNumRule* GetNumRuleFromTxtNode(const SwTxtNode &rTxtNd);
         const SwNumRule* GetNormalNumRuleFromTxtNode(const SwTxtNode &rTxtNd);
 
-
         /** Get the SwNoTxtNode associated with a SwFrmFmt if here is one
 
             There are two differing types of numbering formats that may be on a
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index b2468163acbe..d19e26052fac 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -1008,8 +1008,8 @@ const SwNumFmt* SwWW8FltControlStack::GetNumFmtFromStack(const SwPosition &rPos,
         if (rTxtNode.IsCountedInList())
         {
             const SwNumRule *pRule = pDoc->FindNumRulePtr(sName);
-            sal_uInt8 nLvl = static_cast< sal_uInt8 >(rTxtNode.GetActualListLevel());
-            pRet = &(pRule->Get(nLvl));
+
+            pRet = GetNumFmtFromSwNumRuleLevel(*pRule, rTxtNode.GetActualListLevel());
         }
     }
     return pRet;