core.git: filter/source

[Caolán McNamara (via logerrit)]

 filter/source/msfilter/svdfppt.cxx |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

New commits:
commit 90248dca6bbe4a33f3d91a3cd5d7bd7d904ef8ce
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Sun Dec 1 16:08:57 2024 +0000
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Sun Dec 1 19:20:55 2024 +0100

    cid#1608083 Overflowed constant
    
    Change-Id: I1aaa2ca5711b932676621ee37b00fd0683593214
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/177619
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/filter/source/msfilter/svdfppt.cxx 
b/filter/source/msfilter/svdfppt.cxx
index 676f66b57cef..bea4a2aec8e5 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -4857,7 +4857,14 @@ void PPTStyleTextPropReader::ReadParaProps(SvStream& 
rIn, const DffRecordHeader&
                 std::min(sal_uInt16(8),
                     aParaPropSet.mxParaSet->mnDepth);
 
-            nCharCount--;
+            if (nCharCount > 0)
+                --nCharCount;
+            else
+            {
+                SAL_WARN("filter.ms", "Suspicious 0 CharCount");
+                // will clip to legal length in later check in this loop
+                nCharCount = std::numeric_limits<sal_uInt32>::max();
+            }
 
             rIn.ReadUInt32( nMask );
             aSet.mnAttrSet = nMask & 0x207df7;