filter/source/graphicfilter/idxf/dxfentrd.cxx | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
New commits:
commit 50a3e578e82a11c3106927b0f59e7d6e19770cc0
Author: Caolán McNamara <caol...@redhat.com>
Date: Tue Jan 17 21:35:40 2017 +0000
ofz: fix other similar pattern
Change-Id: Ida04023df12186ef299c7f82e85778af7edb7d0a
diff --git a/filter/source/graphicfilter/idxf/dxfentrd.cxx
b/filter/source/graphicfilter/idxf/dxfentrd.cxx
index a3e64f1..a91ecb2 100644
--- a/filter/source/graphicfilter/idxf/dxfentrd.cxx
+++ b/filter/source/graphicfilter/idxf/dxfentrd.cxx
@@ -424,6 +424,8 @@ void DXFLWPolyLineEntity::EvaluateGroup( DXFGroupReader &
rDGR )
// limit alloc to max reasonable size based on remaining data in
stream
if (nCount > 0 && static_cast<sal_uInt32>(nCount) <=
rDGR.remainingSize())
pP.reset( new DXFVector[ nCount ] );
+ else
+ nCount = 0;
}
break;
case 70: nFlags = rDGR.GetI(); break;
@@ -581,8 +583,11 @@ bool DXFBoundaryPathData::EvaluateGroup( DXFGroupReader &
rDGR )
case 93 :
{
nPointCount = rDGR.GetI();
- if ( nPointCount )
+ // limit alloc to max reasonable size based on remaining data
in stream
+ if (nPointCount > 0 && static_cast<sal_uInt32>(nPointCount) <=
rDGR.remainingSize())
pP.reset( new DXFVector[ nPointCount ] );
+ else
+ nPointCount = 0;
}
break;
case 72 : nHasBulgeFlag = rDGR.GetI(); break;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
