diff options
Diffstat (limited to 'sw/source/filter/ww8/ww8toolbar.cxx')
| -rw-r--r-- | sw/source/filter/ww8/ww8toolbar.cxx | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sw/source/filter/ww8/ww8toolbar.cxx b/sw/source/filter/ww8/ww8toolbar.cxx index ffb210b63492..35be1a7b65a1 100644 --- a/sw/source/filter/ww8/ww8toolbar.cxx +++ b/sw/source/filter/ww8/ww8toolbar.cxx @@ -1105,6 +1105,8 @@ bool TcgSttbfCore::Read( SvStream& rS ) rS.ReadUInt16( fExtend ).ReadUInt16( cData ).ReadUInt16( cbExtra ); if ( cData ) { + if (cData > rS.remainingSize() / 4) //definitely an invalid record + return false; dataItems = new SBBItem[ cData ]; for ( sal_Int32 index = 0; index < cData; ++index ) { |