basegfx/source/tools/stringconversiontools.cxx | 2 - filter/source/svg/svgreader.cxx | 45 +++++++++++++------------ 2 files changed, 25 insertions(+), 22 deletions(-)
New commits: commit cb7d12ea4d67278edaf0240a67221ca5d5d8e93c Author: Caolán McNamara <caol...@redhat.com> Date: Tue Feb 9 10:05:07 2016 +0000 crashtesting: crash on loading moz414782-1.svg Change-Id: I1324b902c0790350bc8c44e7d63ce45915e3b33f diff --git a/basegfx/source/tools/stringconversiontools.cxx b/basegfx/source/tools/stringconversiontools.cxx index f8181a6..8ea8624 100644 --- a/basegfx/source/tools/stringconversiontools.cxx +++ b/basegfx/source/tools/stringconversiontools.cxx @@ -50,7 +50,7 @@ namespace basegfx sal_Int32& io_rPos, const OUString& rStr) { - sal_Unicode aChar( rStr[io_rPos] ); + sal_Unicode aChar = io_rPos < rStr.getLength() ? rStr[io_rPos] : 0; OUStringBuffer sNumberString; // sign commit 3d42c1fc15c4c2dacf5da7d6555e3fc7ac10416c Author: Caolán McNamara <caol...@redhat.com> Date: Tue Feb 9 09:56:43 2016 +0000 crashtesting: crash on loading moz330387-6.svg Change-Id: I9bba4cd9332320285c06ca3ba8eaf94ab89dfeef diff --git a/filter/source/svg/svgreader.cxx b/filter/source/svg/svgreader.cxx index f3aeb17..243aa2c 100644 --- a/filter/source/svg/svgreader.cxx +++ b/filter/source/svg/svgreader.cxx @@ -348,29 +348,32 @@ struct AnnotatingVisitor } case XML_STOP: { - const sal_Int32 nNumAttrs( xAttributes->getLength() ); - maGradientStopVector.push_back(GradientStop()); - maGradientVector.back().maStops.push_back(maGradientStopVector.size()-1); - - // first parse 'color' as 'stop-color' might depend on it - // if 'stop-color''s value is "currentColor" and parsed previously - uno::Reference<xml::dom::XNode> xNodeColor(xAttributes->getNamedItem("color")); - if(xNodeColor.is()) - parseGradientStop( maGradientStopVector.back(), - maGradientStopVector.size()-1, - XML_STOP_COLOR, - xNodeColor->getNodeValue() ); - - //now, parse the rest of attributes - for( sal_Int32 i=0; i<nNumAttrs; ++i ) + if (!maGradientVector.empty()) { - const sal_Int32 nTokenId( - getTokenId(xAttributes->item(i)->getNodeName())); - if ( nTokenId != XML_COLOR ) + const sal_Int32 nNumAttrs( xAttributes->getLength() ); + maGradientStopVector.push_back(GradientStop()); + maGradientVector.back().maStops.push_back(maGradientStopVector.size()-1); + + // first parse 'color' as 'stop-color' might depend on it + // if 'stop-color''s value is "currentColor" and parsed previously + uno::Reference<xml::dom::XNode> xNodeColor(xAttributes->getNamedItem("color")); + if(xNodeColor.is()) parseGradientStop( maGradientStopVector.back(), - maGradientStopVector.size()-1, - nTokenId, - xAttributes->item(i)->getNodeValue() ); + maGradientStopVector.size()-1, + XML_STOP_COLOR, + xNodeColor->getNodeValue() ); + + //now, parse the rest of attributes + for( sal_Int32 i=0; i<nNumAttrs; ++i ) + { + const sal_Int32 nTokenId( + getTokenId(xAttributes->item(i)->getNodeName())); + if ( nTokenId != XML_COLOR ) + parseGradientStop( maGradientStopVector.back(), + maGradientStopVector.size()-1, + nTokenId, + xAttributes->item(i)->getNodeValue() ); + } } break; }
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits