sd/qa/unit/data/ppt/pass/hang-22.ppt |binary sd/source/filter/ppt/propread.cxx | 4 +++- 2 files changed, 3 insertions(+), 1 deletion(-)
New commits: commit 7af19f45b35c428d3e06972806e5a05489f45955 Author: Caolán McNamara <caol...@redhat.com> Date: Fri Sep 18 13:20:03 2015 +0100 check stream status and string lengths Change-Id: I99f3d4a2ec760228f485d01fce856deb9c068431 diff --git a/sd/qa/unit/data/ppt/pass/hang-22.ppt b/sd/qa/unit/data/ppt/pass/hang-22.ppt new file mode 100644 index 0000000..c869b39 Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-22.ppt differ diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx index b76fbca..03e05d0 100644 --- a/sd/source/filter/ppt/propread.cxx +++ b/sd/source/filter/ppt/propread.cxx @@ -288,7 +288,9 @@ void Section::GetDictionary(Dictionary& rDict) for (sal_uInt32 i = 0; i < nDictCount; ++i) { sal_uInt32 nId(0), nSize(0); - aStream.ReadUInt32( nId ).ReadUInt32( nSize ); + aStream.ReadUInt32(nId).ReadUInt32(nSize); + if (!aStream.good() || nSize > aStream.remainingSize()) + break; if (mnTextEnc == RTL_TEXTENCODING_UCS2) nSize >>= 1; if (!nSize)
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits