From 9e862bad71528addc57567db679e22ae176760ce Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 30 Oct 2020 10:01:45 +0000
Subject: ofz#26753 avoid infinite regress
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I3f5f14aa63c234ffdf1acd8bb730ce0ff08c7a81
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105043
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
---
 sw/source/filter/ww8/ww8par.hxx  |  2 +-
 sw/source/filter/ww8/ww8par6.cxx | 17 ++++++++++++-----
 2 files changed, 13 insertions(+), 6 deletions(-)

(limited to 'sw/source/filter')

diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index 37ff8b1275ae..01020a3343a1 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -1757,7 +1757,7 @@ public:     // really private, but can only be done public
 
     void SetRelativeJustify( bool bRel );
     bool IsRelativeJustify();
-    bool IsRelativeJustify( sal_uInt16 nColl );
+    bool IsRelativeJustify(sal_uInt16 nColl, o3tl::sorted_vector<sal_uInt16>& rVisitedStyles);
     void Read_Justify(sal_uInt16, const sal_uInt8*, short nLen);
 
     void Read_IdctHint(sal_uInt16, const sal_uInt8*, short nLen);
diff --git a/sw/source/filter/ww8/ww8par6.cxx b/sw/source/filter/ww8/ww8par6.cxx
index 59e5b6beb731..36656d82c341 100644
--- a/sw/source/filter/ww8/ww8par6.cxx
+++ b/sw/source/filter/ww8/ww8par6.cxx
@@ -326,7 +326,10 @@ bool SwWW8ImplReader::IsRelativeJustify()
         {
             sal_Int16 nRelative = m_vColl[m_nCurrentColl].m_nRelativeJustify;
             if ( nRelative < 0 && m_nCurrentColl )
-                bRet = IsRelativeJustify( m_vColl[m_nCurrentColl].m_nBase );
+            {
+                o3tl::sorted_vector<sal_uInt16> aVisitedStyles;
+                bRet = IsRelativeJustify(m_vColl[m_nCurrentColl].m_nBase, aVisitedStyles);
+            }
             else
                 bRet = nRelative > 0;
         }
@@ -334,7 +337,10 @@ bool SwWW8ImplReader::IsRelativeJustify()
         {
             sal_Int16 nRelative = m_xPlcxMan->GetPap()->nRelativeJustify;
             if ( nRelative < 0 )
-                bRet = IsRelativeJustify( m_nCurrentColl );
+            {
+                o3tl::sorted_vector<sal_uInt16> aVisitedStyles;
+                bRet = IsRelativeJustify(m_nCurrentColl, aVisitedStyles);
+            }
             else
                 bRet = nRelative > 0;
         }
@@ -343,19 +349,20 @@ bool SwWW8ImplReader::IsRelativeJustify()
     return bRet;
 }
 
-bool SwWW8ImplReader::IsRelativeJustify( sal_uInt16 nColl )
+bool SwWW8ImplReader::IsRelativeJustify(sal_uInt16 nColl, o3tl::sorted_vector<sal_uInt16>& rVisitedStyles)
 {
     assert( m_xWwFib->GetFIBVersion() >= ww::eWW8
         && "pointless to search styles if relative justify is impossible");
     bool bRet = true;
     if ( StyleExists(nColl) )
     {
+        rVisitedStyles.insert(nColl);
         // if relativeJustify is undefined (-1), then check the parent style.
         sal_Int16 nRelative = m_vColl[nColl].m_nRelativeJustify;
         if ( nColl == 0 || nRelative >= 0 )
             bRet = nRelative > 0;
-        else if ( nColl != m_vColl[nColl].m_nBase )
-            bRet = IsRelativeJustify( m_vColl[nColl].m_nBase );
+        else if (rVisitedStyles.find(m_vColl[nColl].m_nBase) == rVisitedStyles.end()) // detect loop in chain
+            bRet = IsRelativeJustify(m_vColl[nColl].m_nBase, rVisitedStyles);
     }
 
     return bRet;
-- 
cgit