This is an automated email from the ASF dual-hosted git repository.

ardovm pushed a commit to branch AOO41X
in repository https://gitbox.apache.org/repos/asf/openoffice.git

commit 8b45e15366a4ad8487d7bf9dca498bd1c15753be
Author: Peter Kovacs <[email protected]>
AuthorDate: Sat Aug 1 12:53:44 2026 +0200

    sw: ww8: validate PLCF length
    
    Add an inline WW8PLCF::IsValidLength() predicate and call it at the
    entry of both WW8PLCF::ReadPLCF and the WW8PLCFspecial constructor.
    
    Add GoogleTest_sw_ww8plcf covering the boundary values.
    
    Thanks to Yukihiro Nakamura ([email protected])
    
    Co-authored-by: Yukihiro Nakamura ([email protected])
    Co-Authored-By: Claude Opus 5 <[email protected]>
    (cherry picked and adapted from commit 
8604ca21f9283f811f592bd95847a6002173ce6e)
---
 main/sw/source/filter/ww8/ww8scan.cxx | 15 +++++++++++++++
 main/sw/source/filter/ww8/ww8scan.hxx |  5 ++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/main/sw/source/filter/ww8/ww8scan.cxx 
b/main/sw/source/filter/ww8/ww8scan.cxx
index 7c89801caa..f5a2d7955a 100644
--- a/main/sw/source/filter/ww8/ww8scan.cxx
+++ b/main/sw/source/filter/ww8/ww8scan.cxx
@@ -2208,6 +2208,15 @@ WW8PLCFspecial::WW8PLCFspecial(SvStream* pSt, long 
nFilePos, long nPLCF,
     long nStruct, long nStartPos)
     : nIdx(0), nStru(nStruct)
 {
+    if (!WW8PLCF::IsValidLength(static_cast<sal_Int32>(nPLCF)))
+    {
+        nIMax = 0;
+        pPLCF_PosArray = new sal_Int32[1];
+        pPLCF_PosArray[0] = WW8_CP_MAX;
+        pPLCF_Contents = 0;
+        return;
+    }
+
     nIMax = ( nPLCF - 4 ) / ( 4 + nStruct );
     // Pointer auf Pos- u. Struct-Array
     pPLCF_PosArray = new sal_Int32[ ( nPLCF + 3 ) / 4 ];
@@ -2382,6 +2391,12 @@ void WW8PLCF::ReadPLCF( SvStream* pSt, WW8_FC nFilePos, 
sal_Int32 nPLCF )
 {
     bool failure = false;
 
+    if (!IsValidLength(nPLCF))
+    {
+        MakeFailedPLCF();
+        return;
+    }
+
     // Pointer auf Pos-Array
     pPLCF_PosArray = new WW8_CP[ ( nPLCF + 3 ) / 4 ];
 
diff --git a/main/sw/source/filter/ww8/ww8scan.hxx 
b/main/sw/source/filter/ww8/ww8scan.hxx
index 137fbe1174..8dfc613b79 100644
--- a/main/sw/source/filter/ww8/ww8scan.hxx
+++ b/main/sw/source/filter/ww8/ww8scan.hxx
@@ -292,7 +292,10 @@ private:
 
     void MakeFailedPLCF();
 public:
-    WW8PLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct, 
+    static bool IsValidLength( sal_Int32 nPLCF )
+    { return nPLCF >= 1 && nPLCF <= ( WW8_CP_MAX - 4 ); }
+
+    WW8PLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
         WW8_CP nStartPos = -1 );
 
     /*

Reply via email to