CID#736212 clip word 2 pap bounds

and add a unit test for the word 2..5 formats

Change-Id: I6c7c26be6092acbb81282080de6c393d92ad5dd4

sw/qa/core/filters-test.cxx

@@ -104,6 +104,10 @@ void SwFiltersTest::testCVEs()
             getURLFromSrc("/sw/qa/core/data/ww8/"),
             OUString(FILTER_WW8));
 
+    testDir(OUString("MS WinWord 5"),
+            getURLFromSrc("/sw/qa/core/data/ww5/"),
+            OUString(sWW5));
+
     testDir(OUString("Text (encoded)"),
             getURLFromSrc("/sw/qa/core/data/txt/"),
             OUString(FILTER_TEXT_DLG));

sw/source/filter/ww8/ww8scan.cxx

@@ -2496,7 +2496,15 @@ WW8PLCFx_Fc_FKP::WW8Fkp::WW8Fkp(ww::WordVersion eVersion, SvStream* pSt,
                                 {
                                     aEntry.mnLen-=6; //PHE
                                     //skipi stc, len byte + 6 byte PHE
-                                    aEntry.mpData = maRawData + nOfs + 8;
+                                    unsigned int nOffset = nOfs + 8;
+                                    if (nOffset >= 511) //Bad offset
+                                        aEntry.mnLen=0;
+                                    if (aEntry.mnLen)   //start is ok
+                                    {
+                                        if (nOffset + aEntry.mnLen > 512)   //Bad end, clip
+                                            aEntry.mnLen = 512 - nOffset;
+                                        aEntry.mpData = maRawData + nOffset;
+                                    }
                                 }
                                 else
                                     aEntry.mnLen=0; //Too short