commit e4551b905e12aa92b7509d9b994bfae5dec3d8e0
author Caolán McNamara <caolanm@redhat.com> Mon Nov 06 12:57:57 2017 +0000
committer Caolán McNamara <caolanm@redhat.com> Mon Nov 06 18:33:02 2017 +0100
tree f5fae8db42321ea918db50b756c7b24434afae55
parent f037207675010fdff2c1968a67fae5b0c2c34331

ofz infinite loop

Change-Id: Iae9faaa86e4b3edb9a1fdfe9c6b67eee211c19a9
Reviewed-on: https://gerrit.libreoffice.org/44361
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

editeng/source/rtf/svxrtf.cxx

diff --git a/editeng/source/rtf/svxrtf.cxx b/editeng/source/rtf/svxrtf.cxx
index f84a30f..568abc0 100644
--- a/editeng/source/rtf/svxrtf.cxx
+++ b/editeng/source/rtf/svxrtf.cxx
@@ -294,8 +294,11 @@ void SvxRTFParser::ReadStyleTable()
    bIsInReadStyleTab = true;
    bChkStyleAttr = false;      // Do not check Attribute against the Styles

    while( _nOpenBrakets && IsParserWorking() )
    bool bLooping = false;

    while (_nOpenBrakets && IsParserWorking() && !bLooping)
    {
        auto nCurrentTokenIndex = m_nTokenIndex;
        int nToken = GetNextToken();
        switch( nToken )
        {
@@ -378,6 +381,7 @@ void SvxRTFParser::ReadStyleTable()
            }
            break;
        }
        bLooping = nCurrentTokenIndex == m_nTokenIndex;
    }
    pStyle.reset();         // Delete the Last Style
    SkipToken();        // the closing brace is evaluated "above"

include/svtools/svparser.hxx

diff --git a/include/svtools/svparser.hxx b/include/svtools/svparser.hxx
index 5ab0df9..2d3eaee 100644
--- a/include/svtools/svparser.hxx
+++ b/include/svtools/svparser.hxx
@@ -54,6 +54,7 @@ protected:
    sal_uLong           nlLinePos;          // current column number

    std::unique_ptr<SvParser_Impl<T>> pImplData; // internal data
    long                m_nTokenIndex;      // current token index to detect loops for seeking backwards
    long                nTokenValue;        // additional value (RTF)
    bool                bTokenHasValue;     // indicates whether nTokenValue is valid
    SvParserState       eState;             // status also in derived classes

svtools/source/svrtf/parrtf.cxx

diff --git a/svtools/source/svrtf/parrtf.cxx b/svtools/source/svrtf/parrtf.cxx
index cd2b453..bcdb67b 100644
--- a/svtools/source/svrtf/parrtf.cxx
+++ b/svtools/source/svrtf/parrtf.cxx
@@ -600,8 +600,12 @@ void SvRTFParser::Continue( int nToken )
    if( !nToken )
        nToken = GetNextToken();

    while( IsParserWorking() )
    bool bLooping = false;

    while (IsParserWorking() && !bLooping)
    {
        auto nCurrentTokenIndex = m_nTokenIndex;

        SaveState( nToken );
        switch( nToken )
        {
@@ -658,6 +662,8 @@ NEXTTOKEN:
            SaveState( 0 );         // processed till here,
                                    // continue with new token!
        nToken = GetNextToken();

        bLooping = nCurrentTokenIndex == m_nTokenIndex;
    }
    if( SvParserState::Accepted == eState && 0 < nOpenBrakets )
        eState = SvParserState::Error;

svtools/source/svrtf/svparser.cxx

diff --git a/svtools/source/svrtf/svparser.cxx b/svtools/source/svrtf/svparser.cxx
index 2d1be0e..bfcc511 100644
--- a/svtools/source/svrtf/svparser.cxx
+++ b/svtools/source/svrtf/svparser.cxx
@@ -76,6 +76,7 @@ SvParser<T>::SvParser( SvStream& rIn, sal_uInt8 nStackSize )
    , nlLineNr( 1 )
    , nlLinePos( 1 )
    , pImplData( nullptr )
    , m_nTokenIndex(0)
    , nTokenValue( 0 )
    , bTokenHasValue( false )
    , eState( SvParserState::NotStarted )
@@ -476,6 +477,7 @@ T SvParser<T>::GetNextToken()
        bTokenHasValue = pTokenStackPos->bTokenHasValue;
        aToken = pTokenStackPos->sToken;
        nRet = pTokenStackPos->nTokenId;
        ++m_nTokenIndex;
    }
    // no, now push actual value on stack
    else if( SvParserState::Working == eState )
@@ -484,6 +486,7 @@ T SvParser<T>::GetNextToken()
        pTokenStackPos->nTokenValue = nTokenValue;
        pTokenStackPos->bTokenHasValue = bTokenHasValue;
        pTokenStackPos->nTokenId = nRet;
        ++m_nTokenIndex;
    }
    else if( SvParserState::Accepted != eState && SvParserState::Pending != eState )
        eState = SvParserState::Error;       // an error occurred
@@ -502,6 +505,8 @@ T SvParser<T>::SkipToken( short nCnt )       // "skip" n Tokens backward
        nTmp = nTokenStackSize;
    nTokenStackPos = sal_uInt8(nTmp);

    m_nTokenIndex -= nTmp;

    // restore values
    aToken = pTokenStackPos->sToken;
    nTokenValue = pTokenStackPos->nTokenValue;