From 2eb40fcdb2f3e4e9768fa18ad662c11d52c44ad2 Mon Sep 17 00:00:00 2001
From: os <os@openoffice.org>
Date: Mon, 22 Nov 2010 16:46:59 +0100
Subject: #b7001883# exit if sprm array is invalid

---
 sw/source/filter/ww8/ww8par.cxx  |  9 ++++++++-
 sw/source/filter/ww8/ww8scan.cxx | 17 +++++++++++++----
 2 files changed, 21 insertions(+), 5 deletions(-)

(limited to 'sw/source')

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 24f36b047a4e..cd11631a0181 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -4919,7 +4919,14 @@ ULONG WW8Reader::Read(SwDoc &rDoc, const String& rBaseURL, SwPaM &rPam, const St
         }
         SwWW8ImplReader* pRdr = new SwWW8ImplReader(nVersion, pStg, pIn, rDoc,
             rBaseURL, bNew);
-        nRet = pRdr->LoadDoc( rPam );
+        try
+        {
+            nRet = pRdr->LoadDoc( rPam );
+        }
+        catch( const std::exception& )
+        {
+            nRet = ERR_WW8_NO_WW8_FILE_ERR;
+        }
         delete pRdr;
 
         if( refStrm.Is() )
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index d64e207313d8..171e45260818 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -892,11 +892,18 @@ void WW8SprmIter::SetSprms(const BYTE* pSprms_, long nLen_)
 
 const BYTE* WW8SprmIter::operator ++( int )
 {
-    if (nRemLen > 0)
+    if (nRemLen > 0 )
     {
-        pSprms += nAktSize;
-        nRemLen -= nAktSize;
-        UpdateMyMembers();
+        if( nRemLen >= nAktSize )
+        {
+            pSprms += nAktSize;
+            nRemLen -= nAktSize;
+            UpdateMyMembers();
+        }
+        else
+        {
+            throw( ::std::exception() );
+        }
     }
     return pSprms;
 }
@@ -3247,6 +3254,8 @@ void WW8PLCFx_Cp_FKP::GetSprms(WW8PLCFxDesc* p)
         Otherwise our cool fastsave algorithm can be brought to bear on the
         problem.
         */
+        if( !pPieceIter )
+            return;
         ULONG nOldPos = pPieceIter->GetIdx();
         bool bOk = pPieceIter->SeekPos(nOrigCp);
         pPieceIter->SetIdx( nOldPos );
-- 
cgit