diff options
| author | Steve Yin <steve_y@apache.org> | 2014-04-15 10:12:14 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-04-16 11:58:06 +0100 |
| commit | b827f6f81f6a8f6d8046a278a18acb69e780afba (patch) | |
| tree | 33fbaab02042e0155835d01e098b81016cb00b5d | |
| parent | d8c6707b118f6da34218d806166a13ee9ab12460 (diff) | |
Related: #i124661# crash when loading and re-saving ppt file...
with a single customshape
check the equation array element number. If the number is greater than 128, the
equation array will not be imported.
(cherry picked from commit 48653aa3a1cc24ed9ad8a14ae035b38a751e561d)
Conflicts:
filter/source/msfilter/msdffimp.cxx
Change-Id: I49ac6ec5610a7761ca3ed4905d6fe1bc7ec079d0
| -rw-r--r-- | filter/source/msfilter/escherex.cxx | 2 | ||||
| -rw-r--r-- | filter/source/msfilter/msdffimp.cxx | 26 |
2 files changed, 15 insertions, 13 deletions
diff --git a/filter/source/msfilter/escherex.cxx b/filter/source/msfilter/escherex.cxx index 7e495db117e4..db1473fec3a1 100644 --- a/filter/source/msfilter/escherex.cxx +++ b/filter/source/msfilter/escherex.cxx @@ -2582,7 +2582,7 @@ void ConvertEnhancedCustomShapeEquation( SdrObjCustomShape* pCustoShape, if ( pAny ) *pAny >>= sEquationSource; sal_Int32 nEquationSourceCount = sEquationSource.getLength(); - if ( nEquationSourceCount ) + if ( nEquationSourceCount && (nEquationSourceCount <= 128) ) { sal_Int32 i; for ( i = 0; i < nEquationSourceCount; i++ ) diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx index d7d6ba8ea11d..eb2e91de3053 100644 --- a/filter/source/msfilter/msdffimp.cxx +++ b/filter/source/msfilter/msdffimp.cxx @@ -1866,20 +1866,22 @@ void DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt sal_uInt16 nElemSize = 8; rIn.ReadUInt16( nNumElem ).ReadUInt16( nNumElemMem ).ReadUInt16( nElemSize ); } - sal_Int16 nP1, nP2, nP3; - sal_uInt16 nFlags; - - uno::Sequence< OUString > aEquations( nNumElem ); - for ( sal_uInt16 i = 0; i < nNumElem; i++ ) + if ( nNumElem <= 128 ) { - rIn.ReadUInt16( nFlags ).ReadInt16( nP1 ).ReadInt16( nP2 ).ReadInt16( nP3 ); - aEquations[ i ] = EnhancedCustomShape2d::GetEquation( nFlags, nP1, nP2, nP3 ); + uno::Sequence< OUString > aEquations( nNumElem ); + for ( sal_uInt16 i = 0; i < nNumElem; i++ ) + { + sal_Int16 nP1(0), nP2(0), nP3(0); + sal_uInt16 nFlags(0); + rIn.ReadUInt16( nFlags ).ReadInt16( nP1 ).ReadInt16( nP2 ).ReadInt16( nP3 ); + aEquations[ i ] = EnhancedCustomShape2d::GetEquation( nFlags, nP1, nP2, nP3 ); + } + // pushing the whole Equations element + const OUString sEquations( "Equations" ); + aProp.Name = sEquations; + aProp.Value <<= aEquations; + aPropVec.push_back( aProp ); } - // pushing the whole Equations element - const OUString sEquations( "Equations" ); - aProp.Name = sEquations; - aProp.Value <<= aEquations; - aPropVec.push_back( aProp ); } |