ofz+ubsan: signed integer overflow

Change-Id: I950fb60f9bc7d86a2fe6c64a3d8e62d29ab29817
Reviewed-on: https://gerrit.libreoffice.org/43538Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

sw/source/filter/ww8/ww8scan.cxx

@@ -2081,7 +2081,13 @@ WW8PLCF::WW8PLCF(SvStream& rSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
     WW8_CP nStartPos, sal_Int32 nPN, sal_Int32 ncpN): pPLCF_PosArray(nullptr), nIdx(0),
     nStru(nStruct)
 {
-    nIMax = ( nPLCF - 4 ) / ( 4 + nStruct );
+    if (nPLCF < 0)
+    {
+        SAL_WARN("sw.ww8", "broken WW8PLCF, ignoring");
+        nIMax = SAL_MAX_INT32;
+    }
+    else
+        nIMax = (nPLCF - 4) / (4 + nStruct);
 
     if( nIMax >= ncpN )
         ReadPLCF(rSt, nFilePos, nPLCF);