Fixed core dump and invalid memory access for some edge cases

sw/source/core/doc/docnew.cxx

@@ -909,9 +909,9 @@ void SwDoc::UpdateLinks( sal_Bool bUI )
 {
     SfxObjectCreateMode eMode;
     sal_uInt16 nLinkMode = getLinkUpdateMode( true );
+    if ( GetDocShell()) {
         sal_uInt16 nUpdateDocMode = GetDocShell()->GetUpdateDocMode();
-    if( GetDocShell() &&
-            (nLinkMode != NEVER ||  document::UpdateDocMode::FULL_UPDATE == nUpdateDocMode) &&
+        if( (nLinkMode != NEVER ||  document::UpdateDocMode::FULL_UPDATE == nUpdateDocMode) &&
             GetLinkManager().GetLinks().Count() &&
             SFX_CREATE_MODE_INTERNAL !=
                         ( eMode = GetDocShell()->GetCreateMode()) &&
@@ -944,6 +944,7 @@ void SwDoc::UpdateLinks( sal_Bool bUI )
                     GetLinkManager().UpdateAllLinks( bAskUpdate, sal_True, sal_False, pDlgParent );
             }
         }
+    }
 
 }
 

sw/source/filter/ww8/ww8par3.cxx

@@ -761,7 +761,7 @@ bool WW8ListManager::ReadLVL(SwNumFmt& rNumFmt, SfxItemSet*& rpItemSet,
     for(nLevelB = 0; nLevelB <= nLevel; ++nLevelB)
     {
         sal_uInt8 nPos = aOfsNumsXCH[nLevelB];
-        if (nPos && sNumString.GetChar(nPos-1) < nMaxLevel)
+        if (nPos && nPos < sNumString.Len()  && sNumString.GetChar(nPos-1) < nMaxLevel)
         {
             if (rNotReallyThere[nLevelB])
                 aOfsNumsXCH[nLevelB] = 0;