Package: libreoffice / 1:4.3.3-2+deb8u11

CVE-2016-4324.diff Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
index 9f35f26..b860650 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
@@ -445,8 +445,13 @@ void RTFDocumentImpl::setNeedSect(bool bNeedSect)
 
 writerfilter::Reference<Properties>::Pointer_t RTFDocumentImpl::getProperties(RTFSprms& rAttributes, RTFSprms& rSprms)
 {
-    int nStyle = m_aStates.top().nCurrentStyleIndex;
-    RTFReferenceTable::Entries_t::iterator it = m_aStyleTableEntries.find(nStyle);
+    RTFReferenceTable::Entries_t::iterator it = m_aStyleTableEntries.end();
+    if (!m_aStates.empty())
+    {
+        int nStyle = m_aStates.top().nCurrentStyleIndex;
+        it = m_aStyleTableEntries.find(nStyle);
+    }
+
     if (it != m_aStyleTableEntries.end())
     {
         RTFReferenceProperties& rProps = *(RTFReferenceProperties*)it->second.get();