Author: steve_y
Date: Tue Apr 15 10:12:14 2014
New Revision: 1587496
URL: http://svn.apache.org/r1587496
Log:
Issue 124661 - crash when loading and re-saving attached ppt file with a single
customshape
check the equation array element number. If the number is greater than 128, the
equation array will not be imported.
Modified:
openoffice/trunk/main/filter/source/msfilter/msdffimp.cxx
Modified: openoffice/trunk/main/filter/source/msfilter/msdffimp.cxx
URL:
http://svn.apache.org/viewvc/openoffice/trunk/main/filter/source/msfilter/msdffimp.cxx?rev=1587496&r1=1587495&r2=1587496&view=diff
==============================================================================
--- openoffice/trunk/main/filter/source/msfilter/msdffimp.cxx (original)
+++ openoffice/trunk/main/filter/source/msfilter/msdffimp.cxx Tue Apr 15
10:12:14 2014
@@ -1996,20 +1996,23 @@ void DffPropertyReader::ApplyCustomShape
if ( SeekToContent( DFF_Prop_pFormulas, rIn ) )
rIn >> nNumElem >> nNumElemMem >> nElemSize;
- sal_Int16 nP1, nP2, nP3;
- sal_uInt16 nFlags;
-
- uno::Sequence< rtl::OUString > aEquations( nNumElem );
- for ( i = 0; i < nNumElem; i++ )
+ if ( nNumElem <= 128 )
{
- rIn >> nFlags >> nP1 >> nP2 >> nP3;
- aEquations[ i ] = EnhancedCustomShape2d::GetEquation(
nFlags, nP1, nP2, nP3 );
+ sal_Int16 nP1, nP2, nP3;
+ sal_uInt16 nFlags;
+
+ uno::Sequence< rtl::OUString > aEquations( nNumElem );
+ for ( i = 0; i < nNumElem; i++ )
+ {
+ rIn >> nFlags >> nP1 >> nP2 >> nP3;
+ aEquations[ i ] =
EnhancedCustomShape2d::GetEquation( nFlags, nP1, nP2, nP3 );
+ }
+ // pushing the whole Equations element
+ const rtl::OUString sEquations(
RTL_CONSTASCII_USTRINGPARAM ( "Equations" ) );
+ aProp.Name = sEquations;
+ aProp.Value <<= aEquations;
+ aPropVec.push_back( aProp );
}
- // pushing the whole Equations element
- const rtl::OUString sEquations( RTL_CONSTASCII_USTRINGPARAM
( "Equations" ) );
- aProp.Name = sEquations;
- aProp.Value <<= aEquations;
- aPropVec.push_back( aProp );
}
////////////////////////////////////////
