core.git: sw/source

[Caolán McNamara (via logerrit)]

 sw/source/filter/ww8/ww8par2.cxx |   22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

New commits:
commit a901b1e307bf2a62e0af7ad5ebbfc77724fab657
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Fri Oct 18 21:55:09 2024 +0100
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Sun Oct 20 15:39:12 2024 +0200

    cid#1606970 Overflowed constant
    
    Change-Id: I676b2db3baeca7e99d63c1078e2b280edb0336fd
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/175184
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index 7919f57d7c71..f70889dd2720 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -4440,11 +4440,23 @@ void WW8RStyle::ImportOldFormatStyles()
 
         if (cb != 0xFF)
         {
-            sal_uInt8 stc2(0);
-            m_rStream.ReadUChar( stc2 );
-            m_rStream.SeekRel(6);
-            nByteCount+=7;
-            sal_uInt8 nRemainder = cb-7;
+            sal_uInt8 nRemainder;
+            if (cb < 7)
+            {
+                SAL_WARN("sw.ww8", "WW8RStyle::ImportOldFormatStyles: expected 
byte count: "
+                    << static_cast<int>(cb) << " to be >= 7");
+                m_rStream.SeekRel(cb);
+                nByteCount += cb;
+                nRemainder = 0;
+            }
+            else
+            {
+                sal_uInt8 stc2(0);
+                m_rStream.ReadUChar(stc2);
+                m_rStream.SeekRel(6);
+                nByteCount += 7;
+                nRemainder = cb-7;
+            }
 
             aPAPXOffsets[stcp].mnOffset = m_rStream.Tell();
             aPAPXOffsets[stcp].mnSize = nRemainder;