Hang/crash in templates

Hello, good people,

We have a crash (on systems with low memory) or hang (with more memory)
in templates. It is a problem with all templates but one can see it in
impress directly, because the template previews are part of the standard
side-bar and we regenerate the template cache there.

I investigated a bit, but then I have no idea how to find more. Just in
case it rings a bell to someone, here are my findings:

In svtools/source/misc/templatefoldercache.cxx, we have this part of code:

402) sal_Int32 nChildren = 0;
403) m_rStorage >> nChildren;
404) TemplateFolderContent& rChildren = _rContent.getSubContents();
405) rChildren.resize( 0 );
406) rChildren.reserve( nChildren );

The line 403 gives us a bogus number relatively big. I received
something bigger then 0x7000 0000.
Then the line 406 will try to preallocate that memory that might be
around 2-4GB. On some systems it crashes, on others it pages and hangs.

Maybe if some QA people could try to bibisect it, it would be nice. The
problem is that one needs to have another machine connected by ssh to be
able to kill the soffice.bin that hangs. But then on some low-memory
laptops, it could crash which would be easier to handle.

F.