   
   };
 *** misc/libwpd-0.8.8/src/lib/WP3TablesGroup.cpp	Wed Jan  3 14:07:55 2007
---- misc/build/libwpd-0.8.8/src/lib/WP3TablesGroup.cpp	Tue Jan 30 16:28:39 2007
+--- misc/build/libwpd-0.8.8/src/lib/WP3TablesGroup.cpp	Tue Apr 17 16:09:58 2007
 ***************
 *** 50,59 ****
   {

  		default:
  			break;
*** misc/libwpd-0.8.8/src/lib/WP5DefinitionGroup.h	Wed Jan  3 14:07:56 2007
--- misc/build/libwpd-0.8.8/src/lib/WP5DefinitionGroup.h	Tue Jan 30 16:28:39 2007
***************
*** 31,37 ****
  class WP5DefinitionGroup_DefineTablesSubGroup : public WP5VariableLengthGroup_SubGroup

*** misc/libwpd-0.8.8/src/lib/WP1Heuristics.cpp	Wed Jan  3 14:07:55 2007
--- misc/build/libwpd-0.8.8/src/lib/WP1Heuristics.cpp	Tue Apr 17 16:20:47 2007
***************
*** 27,32 ****
--- 27,33 ----
  #include "WP1Heuristics.h"
  #include "WP1FileStructure.h"
  #include "libwpd_internal.h"
+ #include <limits>
  
  WPDConfidence WP1Heuristics::isWP1FileFormat(WPXInputStream *input, bool partialContent)
  {
***************
*** 74,81 ****
  				//   <function code>{function length}...{function length}<function code>
  				//   that we observed in variable length WP1 functions 
  				
! 				long functionLength = readU32(input, true);
! 				long closingFunctionLength = 0;
  				WPD_DEBUG_MSG(("WP1Heuristics functionLength = 0x%.8x\n", (unsigned int)functionLength));
  
  				input->seek(functionLength, WPX_SEEK_CUR);
--- 75,84 ----
  				//   <function code>{function length}...{function length}<function code>
  				//   that we observed in variable length WP1 functions 
  				
! 				unsigned long functionLength = readU32(input, true);
! 				if (functionLength > ((std::numeric_limits<uint32_t>::max)() / 2))
! 					return WPD_CONFIDENCE_NONE;
! 				unsigned long closingFunctionLength = 0;
  				WPD_DEBUG_MSG(("WP1Heuristics functionLength = 0x%.8x\n", (unsigned int)functionLength));
  
  				input->seek(functionLength, WPX_SEEK_CUR);
*** misc/libwpd-0.8.8/src/lib/WP1Part.cpp	Wed Jan  3 14:07:55 2007
--- misc/build/libwpd-0.8.8/src/lib/WP1Part.cpp	Tue Apr 17 16:09:57 2007
***************
*** 46,51 ****
--- 46,58 ----
