svgio/source/svgreader/svgtools.cxx |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

New commits:
commit cba8d49b78567edf98f2ce81999d19a3130026b9
Author:     Xisco Fauli <[email protected]>
AuthorDate: Sun Jun 25 18:57:02 2023 +0200
Commit:     Xisco Fauli <[email protected]>
CommitDate: Mon Jun 26 09:52:15 2023 +0200

    tdf#155735: cid#1532475 Out-of-bounds access
    
    Change-Id: Ifb3153cc492d042098398695642cd2530bc3b4b9
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/153564
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit ac1d5da7776af63413c8dc1cd0b64f8943bfd7c6)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/153526

diff --git a/svgio/source/svgreader/svgtools.cxx 
b/svgio/source/svgreader/svgtools.cxx
index f885086497c1..c45f4c5e9c61 100644
--- a/svgio/source/svgreader/svgtools.cxx
+++ b/svgio/source/svgreader/svgtools.cxx
@@ -855,9 +855,8 @@ namespace svgio::svgreader
 
             SvgNumber aVal;
 
-            // create a 3x5 matrix using the first 15 values from the list of 
20 matrix values.
-            // FIXME: support alpha (the last 5 values)
-            for (sal_uInt16 nRow = 0; nRow < 3; ++nRow)
+            // create a 4x4 matrix from the list of 20 matrix values.
+            for (sal_uInt16 nRow = 0; nRow < 4; ++nRow)
             {
                 for (sal_uInt16 nColumn = 0; nColumn < 5; ++nColumn)
                 {
@@ -869,7 +868,9 @@ namespace svgio::svgreader
 
                     if(readNumberAndUnit(rCandidate, nPos, aVal, nLen))
                     {
-                        aMatrix.set(nRow, nColumn, aVal.solve(rInfoProvider));
+                        // ignore the last column
+                        if (nColumn < 4)
+                            aMatrix.set(nRow, nColumn, 
aVal.solve(rInfoProvider));
                         skip_char(rCandidate, ' ', ',', nPos, nLen);
                     }
                 }

Reply via email to