diff options
author | Xisco Fauli <xiscofauli@libreoffice.org> | 2020-07-23 16:52:14 +0200 |
---|---|---|
committer | Miklos Vajna <vmiklos@collabora.com> | 2020-07-29 12:04:35 +0200 |
commit | cd056b91355ea059aa968ef46bc22156adab144d (patch) | |
tree | 20f670ae2cd80186daca18dc9d1adc92beb9e9f4 | |
parent | 7057d6729c865eac4831f9c286421b553a7c4ee9 (diff) |
throw if length of keys and values are different
See https://crashreport.libreoffice.org/stats/signature/%60anonymous%20namespace'::WriteAnimateValues
This is expected to start rejecting broken files, instead of accepting invalid data silently,
as it did before. This is not a regression, and should be indication of corrupted generator,
which is the actual cause of the bug...
Change-Id: I66dbb380e8b2d313e58cddf938d952aed4a635b7
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/99327
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
(cherry picked from commit bcdcdaa5dfc5f1d50e0239055161b71e97f5f022)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/99392
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
-rw-r--r-- | oox/source/ppt/timenode.cxx | 4 | ||||
-rw-r--r-- | sd/source/filter/eppt/pptx-animations.cxx | 2 | ||||
-rw-r--r-- | sd/source/filter/ppt/pptinanimations.cxx | 5 | ||||
-rw-r--r-- | xmloff/source/draw/animationimport.cxx | 8 |
4 files changed, 19 insertions, 0 deletions
diff --git a/oox/source/ppt/timenode.cxx b/oox/source/ppt/timenode.cxx index efc632ebf514..41fb39fba150 100644 --- a/oox/source/ppt/timenode.cxx +++ b/oox/source/ppt/timenode.cxx @@ -33,6 +33,7 @@ #include <com/sun/star/animations/AnimationNodeType.hpp> #include <com/sun/star/animations/Event.hpp> #include <com/sun/star/animations/EventTrigger.hpp> +#include <com/sun/star/io/WrongFormatException.hpp> #include <com/sun/star/presentation/EffectNodeType.hpp> #include <com/sun/star/uno/XComponentContext.hpp> @@ -542,6 +543,9 @@ namespace oox::ppt { } } + if (xAnimate.is() && xAnimate->getValues().getLength() != xAnimate->getKeyTimes().getLength()) + throw css::io::WrongFormatException(); + if( mnNodeType == AnimationNodeType::TRANSITIONFILTER ) { diff --git a/sd/source/filter/eppt/pptx-animations.cxx b/sd/source/filter/eppt/pptx-animations.cxx index 0badff184841..7737a84aa535 100644 --- a/sd/source/filter/eppt/pptx-animations.cxx +++ b/sd/source/filter/eppt/pptx-animations.cxx @@ -208,6 +208,8 @@ void WriteAnimateValues(const FSHelperPtr& pFS, const Reference<XAnimate>& rXAni SAL_INFO("sd.eppt", "animate values, formula: " << sFormula.toUtf8()); + assert(aValues.getLength() == aKeyTimes.getLength()); + pFS->startElementNS(XML_p, XML_tavLst); for (int i = 0; i < aKeyTimes.getLength(); i++) diff --git a/sd/source/filter/ppt/pptinanimations.cxx b/sd/source/filter/ppt/pptinanimations.cxx index be51eb9003e4..8516b063728a 100644 --- a/sd/source/filter/ppt/pptinanimations.cxx +++ b/sd/source/filter/ppt/pptinanimations.cxx @@ -48,6 +48,7 @@ #include <com/sun/star/beans/NamedValue.hpp> #include <com/sun/star/container/XEnumerationAccess.hpp> #include <com/sun/star/drawing/XDrawPage.hpp> +#include <com/sun/star/io/WrongFormatException.hpp> #include <com/sun/star/presentation/ParagraphTarget.hpp> #include <com/sun/star/presentation/TextAnimationType.hpp> #include <comphelper/processfactory.hxx> @@ -2212,6 +2213,10 @@ void AnimationImporter::importAnimateKeyPoints( const Atom* pAtom, const Referen aKeyTimes[nKeyTime] = static_cast<double>(nKeyTime) / static_cast<double>(nKeyTimes - 1); } } + + if (aValues.getLength() != aKeyTimes.getLength()) + throw css::io::WrongFormatException(); + xAnim->setKeyTimes( aKeyTimes ); xAnim->setValues( aValues ); xAnim->setFormula( aFormula ); diff --git a/xmloff/source/draw/animationimport.cxx b/xmloff/source/draw/animationimport.cxx index ebccff3d1a22..84d4407c8c8e 100644 --- a/xmloff/source/draw/animationimport.cxx +++ b/xmloff/source/draw/animationimport.cxx @@ -38,6 +38,7 @@ #include <com/sun/star/animations/Timing.hpp> #include <com/sun/star/animations/Event.hpp> #include <com/sun/star/beans/XPropertySet.hpp> +#include <com/sun/star/io/WrongFormatException.hpp> #include <com/sun/star/xml/sax/XFastAttributeList.hpp> #include <com/sun/star/text/XTextCursor.hpp> #include <com/sun/star/text/XTextRangeCompare.hpp> @@ -1125,8 +1126,15 @@ void AnimationNodeContext::init_node( const css::uno::Reference< css::xml::sax: if( !aValues.isEmpty() ) xAnimate->setValues( mpHelper->convertValueSequence( meAttributeName, aValues ) ); + + if (xAnimate->getValues().getLength() != xAnimate->getKeyTimes().getLength()) + throw css::io::WrongFormatException(); } } + catch (const css::io::WrongFormatException&) + { + throw; + } catch (const RuntimeException&) { OSL_FAIL( "xmloff::AnimationNodeContext::StartElement(), RuntimeException caught!" ); |