filter/source/msfilter/svdfppt.cxx | 4 +++- oox/source/export/drawingml.cxx | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-)
New commits: commit c995322f64530992eb9918a65d922e3294558b5c Author: Karthik <[email protected]> AuthorDate: Fri Oct 10 08:55:10 2025 +0530 Commit: Michael Stahl <[email protected]> CommitDate: Wed Oct 29 15:40:59 2025 +0100 tdf#168843: Sanitize font size read from PPT Add validation checks to SvxFontHeightItem, which is used when reading font size value from a PPT. In LO minimum accepted value for font size is 2pt. Change-Id: Ia027800bc52b797f6f0bf5b28e74ba38ba558d5c Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192139 Tested-by: Jenkins CollaboraOffice <[email protected]> Reviewed-by: Mike Kaganski <[email protected]> (cherry picked from commit f4c3c126d9f43f0e8b066d1eda8669cbec6495fd) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/193076 Reviewed-by: Michael Stahl <[email protected]> Tested-by: Jenkins diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx index e9928a85f1e5..42f5cf81cfae 100644 --- a/filter/source/msfilter/svdfppt.cxx +++ b/filter/source/msfilter/svdfppt.cxx @@ -5591,7 +5591,9 @@ void PPTPortionObj::ApplyTo( SfxItemSet& rSet, SdrPowerPointImport& rManager, T } if ( GetAttrib( PPT_CharAttr_FontHeight, nVal, nDestinationInstance ) ) // Font size in Point { - sal_uInt32 nHeight = rManager.ScalePoint( nVal ); + constexpr sal_uInt32 MIN_FONT_HEIGHT_PT = 2; + sal_uInt32 nHeight = rManager.ScalePoint(std::max(nVal, MIN_FONT_HEIGHT_PT)); + rSet.Put( SvxFontHeightItem( nHeight, 100, EE_CHAR_FONTHEIGHT ) ); rSet.Put( SvxFontHeightItem( nHeight, 100, EE_CHAR_FONTHEIGHT_CJK ) ); rSet.Put( SvxFontHeightItem( nHeight, 100, EE_CHAR_FONTHEIGHT_CTL ) ); diff --git a/oox/source/export/drawingml.cxx b/oox/source/export/drawingml.cxx index 7bbc068a7eb5..6f1a75ee9b10 100644 --- a/oox/source/export/drawingml.cxx +++ b/oox/source/export/drawingml.cxx @@ -2681,6 +2681,8 @@ void DrawingML::WriteRunProperties( const Reference< XPropertySet >& rRun, bool } } + assert(nSize >= 200 && "Minimum accepted value for fontsize(ST_TextFontSize) is 200"); + mpFS->startElementNS( XML_a, nElement, XML_lang, sax_fastparser::UseIf(usLanguage, !usLanguage.isEmpty()), XML_sz, OString::number(nSize),
