From cc9b00329e65619a216da2f52d486acdadad83f3 Mon Sep 17 00:00:00 2001
From: Elena Subbotina <Elena.Subbotina@onlyoffice.com>
Date: Thu, 3 Jul 2025 14:17:49 +0300
Subject: [PATCH] fix bug #75733

---
 MsBinaryFile/DocFile/PieceTable.cpp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/MsBinaryFile/DocFile/PieceTable.cpp b/MsBinaryFile/DocFile/PieceTable.cpp
index 1d86090f92..62e85ba31d 100644
--- a/MsBinaryFile/DocFile/PieceTable.cpp
+++ b/MsBinaryFile/DocFile/PieceTable.cpp
@@ -88,9 +88,9 @@ namespace DocFileFormat
 						int indexCpNext = (i+1) * 4;
 						int cpNext = FormatUtils::BytesToInt32(piecetable, indexCpNext, lcb);
 
-						if (cpNext > fib->m_FibBase.fcMac)
+						if (cpNext > streamSize)
 						{
-							cpNext = fib->m_FibBase.fcMac;
+							cpNext = streamSize;
 						}
 
 						//read the PCD
@@ -187,6 +187,8 @@ namespace DocFileFormat
 			pcdFcEnd += (int)pcd.fc;
 
 			int cb = pcdFcEnd - (int)pcd.fc;
+			if (cb < 0)
+				break;
 
 			unsigned char *bytes = new unsigned char[cb];