sd/qa/unit/data/ppt/pass/hang-21.ppt |binary
sd/source/filter/ppt/propread.cxx | 8 ++++++++
2 files changed, 8 insertions(+)
New commits:
commit 2ab9d3eac916468c303f8bf9b919805418f813c1
Author: Caolán McNamara <caol...@redhat.com>
Date: Sat Aug 29 20:26:27 2015 +0100
check stream status
Change-Id: I6b9537cf94ac1c5d996ba64ddf878745dadde254
(cherry picked from commit 452cd9e75de657e996e17510fe5d3539065489d1)
Reviewed-on: https://gerrit.libreoffice.org/18128
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Miklos Vajna <vmik...@collabora.co.uk>
diff --git a/sd/qa/unit/data/ppt/pass/hang-21.ppt
b/sd/qa/unit/data/ppt/pass/hang-21.ppt
new file mode 100644
index 0000000..99cf49f
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-21.ppt differ
diff --git a/sd/source/filter/ppt/propread.cxx
b/sd/source/filter/ppt/propread.cxx
index be288c8..ca9cbe0 100644
--- a/sd/source/filter/ppt/propread.cxx
+++ b/sd/source/filter/ppt/propread.cxx
@@ -497,10 +497,18 @@ void Section::Read( SotStorageStream *pStrm )
{
sal_uInt32 nDictCount(0);
pStrm->ReadUInt32(nDictCount);
+ auto nMaxRecordsPossible = pStrm->remainingSize() /
(sizeof(sal_uInt32)*2);
+ if (nDictCount > nMaxRecordsPossible)
+ {
+ SAL_WARN("sd.filter", "Dictionary count of " << nDictCount <<
" claimed, only " << nMaxRecordsPossible << " possible");
+ nDictCount = nMaxRecordsPossible;
+ }
for (sal_uInt32 i = 0; i < nDictCount; ++i)
{
sal_uInt32 nSize(0);
pStrm->ReadUInt32( nSize ).ReadUInt32( nSize );
+ if (!pStrm->good())
+ break;
sal_uInt64 nPos = pStrm->Tell() + nSize;
if (nPos != pStrm->Seek(nPos))
break;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
