sd/source/filter/ppt/propread.cxx | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
New commits: commit 96976553c41e8e7af47ad3d25927f5018279f6c7 Author: Caolán McNamara <caol...@redhat.com> Date: Sat Oct 21 16:59:19 2017 +0100 check ppt property size against max available len Change-Id: Ie99a68ea34edfb480d41cf832d3044f4bf686585 Reviewed-on: https://gerrit.libreoffice.org/43661 Reviewed-by: Caolán McNamara <caol...@redhat.com> Tested-by: Caolán McNamara <caol...@redhat.com> diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx index ed1f9e4923d2..6854a7dc1a44 100644 --- a/sd/source/filter/ppt/propread.cxx +++ b/sd/source/filter/ppt/propread.cxx @@ -326,7 +326,13 @@ void Section::Read( SotStorageStream *pStrm ) mnTextEnc = RTL_TEXTENCODING_MS_1252; sal_uInt32 nSecSize(0), nPropCount(0); - pStrm->ReadUInt32( nSecSize ).ReadUInt32( nPropCount ); + pStrm->ReadUInt32(nSecSize).ReadUInt32(nPropCount); + if (nSecSize > nStrmSize) + { + SAL_WARN("sd.filter", "Section Len " << nSecSize << " claimed, only " << nStrmSize << " possible"); + nSecSize = nStrmSize; + } + while (nPropCount--) { sal_uInt32 nPropId(0), nPropOfs(0); @@ -514,7 +520,7 @@ void Section::Read( SotStorageStream *pStrm ) } pStrm->Seek(nCurrent); } - pStrm->Seek( nSecOfs + nSecSize ); + pStrm->Seek(nSecOfs + nSecSize); } Section& Section::operator=( const Section& rSection )
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits