starmath/source/mathtype.cxx | 4 ++++
1 file changed, 4 insertions(+)
New commits:
commit 0ecd8c5fe38b039fb15227a21938884f633c0c78
Author: Caolán McNamara <caol...@redhat.com>
Date: Sun Dec 10 11:29:32 2017 +0000
ofz#4570 depth protect mathtype parsing
Change-Id: I1d8ca1704c057e154aa1d3aa57d722c24609cc48
Reviewed-on: https://gerrit.libreoffice.org/46181
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/starmath/source/mathtype.cxx b/starmath/source/mathtype.cxx
index 68e87a3db7de..c7016656a3e1 100644
--- a/starmath/source/mathtype.cxx
+++ b/starmath/source/mathtype.cxx
@@ -646,6 +646,10 @@ void MathType::HandleNudge()
bool MathType::HandleRecords(int nLevel, sal_uInt8 nSelector,
sal_uInt8 nVariation, int nMatrixRows, int nMatrixCols)
{
+ //depth-protect
+ if (nLevel > 2048)
+ return false;
+
sal_uInt8 nTag,nRecord;
sal_uInt8 nTabType,nTabStops;
sal_uInt16 nTabOffset;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
