oox/source/export/drawingml.cxx | 3 +++ xmloff/source/style/xmlbahdl.cxx | 10 ++++++++-- 2 files changed, 11 insertions(+), 2 deletions(-)
New commits: commit 4823ca649caf2c026f36451c1ff32c5aed35583c Author: Noel Grandin <[email protected]> AuthorDate: Wed Dec 3 10:29:50 2025 +0200 Commit: Xisco Fauli <[email protected]> CommitDate: Thu Dec 11 09:35:40 2025 +0100 mso-test: import data has bad percentage value found by converting tdf34406-1.odp to pptx and running officeotron on the output INFO - Validating part "/ppt/slides/slide4.xml" using schema "29500T/pml.xsd" ... ERROR - (slides/slide4.xml:2 col:24,296) cvc-datatype-valid.1.2.3: '-4900000' is not a valid value of union type 'ST_PositiveFixedPercentage'. The import data in content.xml looks like: <style:style style:name="ce8" style:family="table-cell"> <style:graphic-properties draw:fill="solid" draw:fill-color="#808080" draw:opacity="-4900%" where the opacity value is wildly out of range. So validate on input. Change-Id: I1d9146a3f38f975a5e229f63e17fca6fb435439b Reviewed-on: https://gerrit.libreoffice.org/c/core/+/194950 Tested-by: Jenkins CollaboraOffice <[email protected]> Reviewed-by: Michael Stahl <[email protected]> (cherry picked from commit 80c58f15baf79f19b954b1199cbca9c2f3dcf8bf) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/194952 Tested-by: Jenkins Reviewed-by: Noel Grandin <[email protected]> Signed-off-by: Xisco Fauli <[email protected]> Reviewed-on: https://gerrit.libreoffice.org/c/core/+/194958 diff --git a/oox/source/export/drawingml.cxx b/oox/source/export/drawingml.cxx index bba6a62549e1..1652c06c8b25 100644 --- a/oox/source/export/drawingml.cxx +++ b/oox/source/export/drawingml.cxx @@ -368,6 +368,7 @@ void DrawingML::WriteColor( ::Color nColor, sal_Int32 nAlpha ) if( nAlpha < MAX_PERCENT ) { mpFS->startElementNS(XML_a, XML_srgbClr, XML_val, sColor); + assert(nAlpha >= 0); mpFS->singleElementNS(XML_a, XML_alpha, XML_val, OString::number(nAlpha)); mpFS->endElementNS( XML_a, XML_srgbClr ); @@ -414,6 +415,7 @@ void DrawingML::WriteColor( const ::Color nColor, const Sequence< PropertyValue else if(nAlpha < MAX_PERCENT) { mpFS->startElementNS(XML_a, XML_srgbClr, XML_val, sColor); + assert(nAlpha >= 0); mpFS->singleElementNS(XML_a, XML_alpha, XML_val, OString::number(nAlpha)); mpFS->endElementNS(XML_a, XML_srgbClr); } @@ -432,6 +434,7 @@ void DrawingML::WriteColorTransformations( const Sequence< PropertyValue >& aTra { if(nToken == XML_alpha && nAlpha < MAX_PERCENT) { + assert(nAlpha >= 0); mpFS->singleElementNS(XML_a, nToken, XML_val, OString::number(nAlpha)); } else diff --git a/xmloff/source/style/xmlbahdl.cxx b/xmloff/source/style/xmlbahdl.cxx index a59abbdeed04..2749cff5356b 100644 --- a/xmloff/source/style/xmlbahdl.cxx +++ b/xmloff/source/style/xmlbahdl.cxx @@ -455,8 +455,14 @@ bool XMLNegPercentPropHdl::importXML( const OUString& rStrImpValue, Any& rValue, { sal_Int32 nValue = 0; bool bRet = ::sax::Converter::convertPercent( nValue, rStrImpValue ); - if (bRet) - bRet = !o3tl::checked_sub<sal_Int32>(100, nValue, nValue); + if (!bRet) + return false; + if (nValue < 0 || nValue > 100) + { + SAL_WARN("xmloff", "Percentage property out of range, ignoring"); + return false; + } + bRet = !o3tl::checked_sub<sal_Int32>(100, nValue, nValue); if (bRet) lcl_xmloff_setAny( rValue, nValue, nBytes ); return bRet;
