This is an automated email from the ASF dual-hosted git repository. ardovm pushed a commit to branch AOO41X in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 8b45e15366a4ad8487d7bf9dca498bd1c15753be Author: Peter Kovacs <[email protected]> AuthorDate: Sat Aug 1 12:53:44 2026 +0200 sw: ww8: validate PLCF length Add an inline WW8PLCF::IsValidLength() predicate and call it at the entry of both WW8PLCF::ReadPLCF and the WW8PLCFspecial constructor. Add GoogleTest_sw_ww8plcf covering the boundary values. Thanks to Yukihiro Nakamura ([email protected]) Co-authored-by: Yukihiro Nakamura ([email protected]) Co-Authored-By: Claude Opus 5 <[email protected]> (cherry picked and adapted from commit 8604ca21f9283f811f592bd95847a6002173ce6e) --- main/sw/source/filter/ww8/ww8scan.cxx | 15 +++++++++++++++ main/sw/source/filter/ww8/ww8scan.hxx | 5 ++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/main/sw/source/filter/ww8/ww8scan.cxx b/main/sw/source/filter/ww8/ww8scan.cxx index 7c89801caa..f5a2d7955a 100644 --- a/main/sw/source/filter/ww8/ww8scan.cxx +++ b/main/sw/source/filter/ww8/ww8scan.cxx @@ -2208,6 +2208,15 @@ WW8PLCFspecial::WW8PLCFspecial(SvStream* pSt, long nFilePos, long nPLCF, long nStruct, long nStartPos) : nIdx(0), nStru(nStruct) { + if (!WW8PLCF::IsValidLength(static_cast<sal_Int32>(nPLCF))) + { + nIMax = 0; + pPLCF_PosArray = new sal_Int32[1]; + pPLCF_PosArray[0] = WW8_CP_MAX; + pPLCF_Contents = 0; + return; + } + nIMax = ( nPLCF - 4 ) / ( 4 + nStruct ); // Pointer auf Pos- u. Struct-Array pPLCF_PosArray = new sal_Int32[ ( nPLCF + 3 ) / 4 ]; @@ -2382,6 +2391,12 @@ void WW8PLCF::ReadPLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF ) { bool failure = false; + if (!IsValidLength(nPLCF)) + { + MakeFailedPLCF(); + return; + } + // Pointer auf Pos-Array pPLCF_PosArray = new WW8_CP[ ( nPLCF + 3 ) / 4 ]; diff --git a/main/sw/source/filter/ww8/ww8scan.hxx b/main/sw/source/filter/ww8/ww8scan.hxx index 137fbe1174..8dfc613b79 100644 --- a/main/sw/source/filter/ww8/ww8scan.hxx +++ b/main/sw/source/filter/ww8/ww8scan.hxx @@ -292,7 +292,10 @@ private: void MakeFailedPLCF(); public: - WW8PLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct, + static bool IsValidLength( sal_Int32 nPLCF ) + { return nPLCF >= 1 && nPLCF <= ( WW8_CP_MAX - 4 ); } + + WW8PLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct, WW8_CP nStartPos = -1 ); /*
