filter/source/msfilter/svdfppt.cxx | 4 +++- oox/source/export/drawingml.cxx | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-)
New commits: commit f4c3c126d9f43f0e8b066d1eda8669cbec6495fd Author: Karthik <[email protected]> AuthorDate: Fri Oct 10 08:55:10 2025 +0530 Commit: Mike Kaganski <[email protected]> CommitDate: Sat Oct 18 09:39:49 2025 +0200 tdf#168843: Sanitize font size read from PPT Add validation checks to SvxFontHeightItem, which is used when reading font size value from a PPT. In LO minimum accepted value for font size is 2pt. Change-Id: Ia027800bc52b797f6f0bf5b28e74ba38ba558d5c Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192139 Tested-by: Jenkins CollaboraOffice <[email protected]> Reviewed-by: Mike Kaganski <[email protected]> diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx index 72a333a55748..61ea0a2a7266 100644 --- a/filter/source/msfilter/svdfppt.cxx +++ b/filter/source/msfilter/svdfppt.cxx @@ -5587,7 +5587,9 @@ void PPTPortionObj::ApplyTo( SfxItemSet& rSet, SdrPowerPointImport& rManager, T } if ( GetAttrib( PPT_CharAttr_FontHeight, nVal, nDestinationInstance ) ) // Schriftgrad in Point { - sal_uInt32 nHeight = rManager.ScalePoint( nVal ); + constexpr sal_uInt32 MIN_FONT_HEIGHT_PT = 2; + sal_uInt32 nHeight = rManager.ScalePoint(std::max(nVal, MIN_FONT_HEIGHT_PT)); + rSet.Put( SvxFontHeightItem( nHeight, 100, EE_CHAR_FONTHEIGHT ) ); rSet.Put( SvxFontHeightItem( nHeight, 100, EE_CHAR_FONTHEIGHT_CJK ) ); rSet.Put( SvxFontHeightItem( nHeight, 100, EE_CHAR_FONTHEIGHT_CTL ) ); diff --git a/oox/source/export/drawingml.cxx b/oox/source/export/drawingml.cxx index aa04bee3ef1c..cfde589b6562 100644 --- a/oox/source/export/drawingml.cxx +++ b/oox/source/export/drawingml.cxx @@ -2680,6 +2680,8 @@ void DrawingML::WriteRunProperties( const Reference< XPropertySet >& rRun, bool } } + assert(nSize >= 200 && "Minimum accepted value for fontsize(ST_TextFontSize) is 200"); + mpFS->startElementNS( XML_a, nElement, XML_lang, sax_fastparser::UseIf(usLanguage, !usLanguage.isEmpty()), XML_sz, OString::number(nSize),
