Related: i#86517 avoid crash on invalid LEVELTEXT

writerfilter/source/rtftok/rtfdocumentimpl.cxx

@@ -2794,7 +2794,11 @@ int RTFDocumentImpl::popState()
 
         // The first character is the length of the string (the rest should be ignored).
         sal_Int32 nLength(aStr.toChar());
-        OUString aValue = aStr.copy(1, nLength);
+        OUString aValue;
+        if (nLength <= aStr.getLength())
+            aValue = aStr.copy(1, nLength);
+        else
+            aValue = aStr;
         RTFValue::Pointer_t pValue(new RTFValue(aValue, true));
         m_aStates.top().aTableAttributes->push_back(make_pair(NS_ooxml::LN_CT_LevelText_val, pValue));