diff options
| -rw-r--r-- | svl/source/items/macitem.cxx | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/svl/source/items/macitem.cxx b/svl/source/items/macitem.cxx index 24c4cc72294d..29d274039d52 100644 --- a/svl/source/items/macitem.cxx +++ b/svl/source/items/macitem.cxx @@ -103,6 +103,11 @@ SvStream& SvxMacroTableDtor::Read( SvStream& rStrm, sal_uInt16 nVersion ) short nMacro(0); rStrm.ReadInt16(nMacro); + if (nMacro < 0) + { + SAL_WARN("editeng", "Parsing error: negative value " << nMacro); + return rStrm; + } const size_t nMinStringSize = rStrm.GetStreamCharSet() == RTL_TEXTENCODING_UNICODE ? 4 : 2; size_t nMinRecordSize = 2 + 2*nMinStringSize; @@ -110,7 +115,7 @@ SvStream& SvxMacroTableDtor::Read( SvStream& rStrm, sal_uInt16 nVersion ) nMinRecordSize+=2; const size_t nMaxRecords = rStrm.remainingSize() / nMinRecordSize; - if (nMacro > 0 && static_cast<size_t>(nMacro) > nMaxRecords) + if (static_cast<size_t>(nMacro) > nMaxRecords) { SAL_WARN("editeng", "Parsing error: " << nMaxRecords << " max possible entries, but " << nMacro<< " claimed, truncating"); |