filter/source/msfilter/escherex.cxx | 2 +- filter/source/msfilter/msdffimp.cxx | 26 ++++++++++++++------------ 2 files changed, 15 insertions(+), 13 deletions(-)
New commits: commit b827f6f81f6a8f6d8046a278a18acb69e780afba Author: Steve Yin <stev...@apache.org> Date: Tue Apr 15 10:12:14 2014 +0000 Related: #i124661# crash when loading and re-saving ppt file... with a single customshape check the equation array element number. If the number is greater than 128, the equation array will not be imported. (cherry picked from commit 48653aa3a1cc24ed9ad8a14ae035b38a751e561d) Conflicts: filter/source/msfilter/msdffimp.cxx Change-Id: I49ac6ec5610a7761ca3ed4905d6fe1bc7ec079d0 diff --git a/filter/source/msfilter/escherex.cxx b/filter/source/msfilter/escherex.cxx index 7e495db..db1473f 100644 --- a/filter/source/msfilter/escherex.cxx +++ b/filter/source/msfilter/escherex.cxx @@ -2582,7 +2582,7 @@ void ConvertEnhancedCustomShapeEquation( SdrObjCustomShape* pCustoShape, if ( pAny ) *pAny >>= sEquationSource; sal_Int32 nEquationSourceCount = sEquationSource.getLength(); - if ( nEquationSourceCount ) + if ( nEquationSourceCount && (nEquationSourceCount <= 128) ) { sal_Int32 i; for ( i = 0; i < nEquationSourceCount; i++ ) diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx index d7d6ba8..eb2e91d 100644 --- a/filter/source/msfilter/msdffimp.cxx +++ b/filter/source/msfilter/msdffimp.cxx @@ -1866,20 +1866,22 @@ void DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt sal_uInt16 nElemSize = 8; rIn.ReadUInt16( nNumElem ).ReadUInt16( nNumElemMem ).ReadUInt16( nElemSize ); } - sal_Int16 nP1, nP2, nP3; - sal_uInt16 nFlags; - - uno::Sequence< OUString > aEquations( nNumElem ); - for ( sal_uInt16 i = 0; i < nNumElem; i++ ) + if ( nNumElem <= 128 ) { - rIn.ReadUInt16( nFlags ).ReadInt16( nP1 ).ReadInt16( nP2 ).ReadInt16( nP3 ); - aEquations[ i ] = EnhancedCustomShape2d::GetEquation( nFlags, nP1, nP2, nP3 ); + uno::Sequence< OUString > aEquations( nNumElem ); + for ( sal_uInt16 i = 0; i < nNumElem; i++ ) + { + sal_Int16 nP1(0), nP2(0), nP3(0); + sal_uInt16 nFlags(0); + rIn.ReadUInt16( nFlags ).ReadInt16( nP1 ).ReadInt16( nP2 ).ReadInt16( nP3 ); + aEquations[ i ] = EnhancedCustomShape2d::GetEquation( nFlags, nP1, nP2, nP3 ); + } + // pushing the whole Equations element + const OUString sEquations( "Equations" ); + aProp.Name = sEquations; + aProp.Value <<= aEquations; + aPropVec.push_back( aProp ); } - // pushing the whole Equations element - const OUString sEquations( "Equations" ); - aProp.Name = sEquations; - aProp.Value <<= aEquations; - aPropVec.push_back( aProp ); } _______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits