guard against hangs with bogus unsorted plcfs

Change-Id: I91caff583617435add76503498ca4ed361eb5d2e

sw/source/filter/ww8/ww8scan.cxx

@@ -2101,6 +2101,8 @@ void WW8PLCF::ReadPLCF(SvStream& rSt, WW8_FC nFilePos, sal_uInt32 nPLCF)
 #endif // OSL_BIGENDIAN
         // Pointer to content array
         pPLCF_Contents = reinterpret_cast<sal_uInt8*>(&pPLCF_PosArray[nIMax + 1]);
+
+        TruncToSortedRange();
     }
 
     OSL_ENSURE(bValid, "Document has corrupt PLCF, ignoring it");
@@ -2120,6 +2122,21 @@ void WW8PLCF::MakeFailedPLCF()
     pPLCF_Contents = reinterpret_cast<sal_uInt8*>(&pPLCF_PosArray[nIMax + 1]);
 }
 
+void WW8PLCF::TruncToSortedRange()
+{
+    //Docs state that: ... all Plcs ... are sorted in ascending order.
+    //So ensure that here for broken documents.
+    for (auto nI = 0; nI < nIMax; ++nI)
+    {
+        if (pPLCF_PosArray[nI] >= pPLCF_PosArray[nI+1])
+        {
+            SAL_WARN("sw.ww8", "Document has unsorted PLCF, truncated to sorted portion");
+            nIMax = nI;
+            break;
+        }
+    }
+}
+
 void WW8PLCF::GeneratePLCF(SvStream& rSt, sal_Int32 nPN, sal_Int32 ncpN)
 {
     OSL_ENSURE( nIMax < ncpN, "Pcl.Fkp: Why is PLCF too big?" );

sw/source/filter/ww8/ww8scan.hxx

@@ -291,6 +291,7 @@ private:
 
     void MakeFailedPLCF();
 
+    void TruncToSortedRange();
 public:
     WW8PLCF(SvStream& rSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
         WW8_CP nStartPos = -1);