ofz infinite loop

Change-Id: Iae9faaa86e4b3edb9a1fdfe9c6b67eee211c19a9
Reviewed-on: https://gerrit.libreoffice.org/44361Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

editeng/source/rtf/svxrtf.cxx

@@ -294,8 +294,11 @@ void SvxRTFParser::ReadStyleTable()
     bIsInReadStyleTab = true;
     bChkStyleAttr = false;      // Do not check Attribute against the Styles
 
-    while( _nOpenBrakets && IsParserWorking() )
+    bool bLooping = false;
+
+    while (_nOpenBrakets && IsParserWorking() && !bLooping)
     {
+        auto nCurrentTokenIndex = m_nTokenIndex;
         int nToken = GetNextToken();
         switch( nToken )
         {
@@ -378,6 +381,7 @@ void SvxRTFParser::ReadStyleTable()
             }
             break;
         }
+        bLooping = nCurrentTokenIndex == m_nTokenIndex;
     }
     pStyle.reset();         // Delete the Last Style
     SkipToken();        // the closing brace is evaluated "above"

include/svtools/svparser.hxx

@@ -54,6 +54,7 @@ protected:
     sal_uLong           nlLinePos;          // current column number
 
     std::unique_ptr<SvParser_Impl<T>> pImplData; // internal data
+    long                m_nTokenIndex;      // current token index to detect loops for seeking backwards
     long                nTokenValue;        // additional value (RTF)
     bool                bTokenHasValue;     // indicates whether nTokenValue is valid
     SvParserState       eState;             // status also in derived classes

svtools/source/svrtf/parrtf.cxx

@@ -600,8 +600,12 @@ void SvRTFParser::Continue( int nToken )
     if( !nToken )
         nToken = GetNextToken();
 
-    while( IsParserWorking() )
+    bool bLooping = false;
+
+    while (IsParserWorking() && !bLooping)
     {
+        auto nCurrentTokenIndex = m_nTokenIndex;
+
         SaveState( nToken );
         switch( nToken )
         {
@@ -658,6 +662,8 @@ NEXTTOKEN:
             SaveState( 0 );         // processed till here,
                                     // continue with new token!
         nToken = GetNextToken();
+
+        bLooping = nCurrentTokenIndex == m_nTokenIndex;
     }
     if( SvParserState::Accepted == eState && 0 < nOpenBrakets )
         eState = SvParserState::Error;

svtools/source/svrtf/svparser.cxx

@@ -76,6 +76,7 @@ SvParser<T>::SvParser( SvStream& rIn, sal_uInt8 nStackSize )
     , nlLineNr( 1 )
     , nlLinePos( 1 )
     , pImplData( nullptr )
+    , m_nTokenIndex(0)
     , nTokenValue( 0 )
     , bTokenHasValue( false )
     , eState( SvParserState::NotStarted )
@@ -476,6 +477,7 @@ T SvParser<T>::GetNextToken()
         bTokenHasValue = pTokenStackPos->bTokenHasValue;
         aToken = pTokenStackPos->sToken;
         nRet = pTokenStackPos->nTokenId;
+        ++m_nTokenIndex;
     }
     // no, now push actual value on stack
     else if( SvParserState::Working == eState )
@@ -484,6 +486,7 @@ T SvParser<T>::GetNextToken()
         pTokenStackPos->nTokenValue = nTokenValue;
         pTokenStackPos->bTokenHasValue = bTokenHasValue;
         pTokenStackPos->nTokenId = nRet;
+        ++m_nTokenIndex;
     }
     else if( SvParserState::Accepted != eState && SvParserState::Pending != eState )
         eState = SvParserState::Error;       // an error occurred
@@ -502,6 +505,8 @@ T SvParser<T>::SkipToken( short nCnt )       // "skip" n Tokens backward
         nTmp = nTokenStackSize;
     nTokenStackPos = sal_uInt8(nTmp);
 
+    m_nTokenIndex -= nTmp;
+
     // restore values
     aToken = pTokenStackPos->sToken;
     nTokenValue = pTokenStackPos->nTokenValue;