sd/source/filter/ppt/pptin.cxx | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
New commits:
commit 8ae5d297d46c79a73a02c856417804c371a711ac
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Fri Jan 11 11:18:18 2019 +0000
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Fri Jan 11 15:55:46 2019 +0100
ofz#11243 timeout with bogus length
Change-Id: I707f31b704ed6e67183bdbd60ea1c1cc126dac09
Reviewed-on: https://gerrit.libreoffice.org/66161
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx
index 066b8ef203e0..12887386c583 100644
--- a/sd/source/filter/ppt/pptin.cxx
+++ b/sd/source/filter/ppt/pptin.cxx
@@ -1297,7 +1297,15 @@ bool ImplSdPPTImport::Import()
if ( SeekToRec( rStCtrl, PPT_PST_NamedShowSlides,
aCuHeader.GetRecEndFilePos(), &aContent ) )
{
PptSlidePersistList* pPageList = GetPageList(
PPT_SLIDEPAGE );
- sal_uInt32 nSCount = aContent.nRecLen >> 2;
+ const auto nRemainingSize =
rStCtrl.remainingSize();
+ sal_uInt32 nBCount = aContent.nRecLen;
+ if (nBCount > nRemainingSize)
+ {
+ SAL_WARN("filter.ms", "page number data len
longer than remaining stream size");
+ nBCount = nRemainingSize;
+ }
+ sal_uInt32 nSCount = nBCount >> 2;
+
if ( pPageList && nSCount )
{
SdCustomShowList* pList =
mpDoc->GetCustomShowList( true );
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
