filter/source/msfilter/svdfppt.cxx | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
New commits:
commit 76db55774571af5139bce79f595903a2657b7f46
Author: Caolán McNamara <caol...@redhat.com>
Date: Tue Jan 9 16:31:05 2018 +0000
ofz#5154 limit depth to max legal depth
Change-Id: Ic1b0daf874b9df13ad012d11efaee1c31a47b1d6
Reviewed-on: https://gerrit.libreoffice.org/47666
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/filter/source/msfilter/svdfppt.cxx
b/filter/source/msfilter/svdfppt.cxx
index 5f0b33973bb9..32674f5ccf5e 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -3321,7 +3321,8 @@ PPTExtParaProv::PPTExtParaProv( SdrPowerPointImport&
rMan, SvStream& rSt, const
if ( aHd.nRecInstance < PPT_STYLESHEETENTRYS )
{
sal_uInt16 nDepth = 0, i = 0;
- rSt.ReadUInt16( nDepth );
+ rSt.ReadUInt16(nDepth);
+ nDepth = std::min<sal_uInt16>(nDepth, nMaxPPTLevels);
auto nHdEndRecPos = DffPropSet::SanitizeEndPos(rSt,
aHd.GetRecEndFilePos());
while ( ( rSt.GetError() == ERRCODE_NONE ) && (
rSt.Tell() < nHdEndRecPos ) && ( i < nDepth ) )
{
@@ -3409,8 +3410,9 @@ bool PPTNumberFormatCreator::ImplGetExtNumberFormat(
SdrPowerPointImport const &
}
if ( ( nBuFlags & 0x03800000 ) != 0x03800000 ) // merge style sheet
- { // we have to read the master attributes
- if ( pParaProv && ( nLevel < 5 ) )
+ {
+ // we have to read the master attributes
+ if (pParaProv && nLevel < nMaxPPTLevels)
{
if ( pParaProv->bStyles )
{
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
