4 files changed, 19 insertions, 0 deletions
diff --git a/oox/source/ppt/timenode.cxx b/oox/source/ppt/timenode.cxx
index efc632ebf514..41fb39fba150 100644
--- a/oox/source/ppt/timenode.cxx
+++ b/oox/source/ppt/timenode.cxx
@@ -33,6 +33,7 @@
 #include <com/sun/star/animations/AnimationNodeType.hpp>
 #include <com/sun/star/animations/Event.hpp>
 #include <com/sun/star/animations/EventTrigger.hpp>
+#include <com/sun/star/io/WrongFormatException.hpp>
 #include <com/sun/star/presentation/EffectNodeType.hpp>
 #include <com/sun/star/uno/XComponentContext.hpp>
 
@@ -542,6 +543,9 @@ namespace oox::ppt {
                 }
             }
 
+            if (xAnimate.is() && xAnimate->getValues().getLength() != xAnimate->getKeyTimes().getLength())
+                throw css::io::WrongFormatException();
+
             if( mnNodeType == AnimationNodeType::TRANSITIONFILTER )
             {
 
diff --git a/sd/source/filter/eppt/pptx-animations.cxx b/sd/source/filter/eppt/pptx-animations.cxx
index 0badff184841..7737a84aa535 100644
--- a/sd/source/filter/eppt/pptx-animations.cxx
+++ b/sd/source/filter/eppt/pptx-animations.cxx
@@ -208,6 +208,8 @@ void WriteAnimateValues(const FSHelperPtr& pFS, const Reference<XAnimate>& rXAni
 
     SAL_INFO("sd.eppt", "animate values, formula: " << sFormula.toUtf8());
 
+    assert(aValues.getLength() == aKeyTimes.getLength());
+
     pFS->startElementNS(XML_p, XML_tavLst);
 
     for (int i = 0; i < aKeyTimes.getLength(); i++)
diff --git a/sd/source/filter/ppt/pptinanimations.cxx b/sd/source/filter/ppt/pptinanimations.cxx
index be51eb9003e4..8516b063728a 100644
--- a/sd/source/filter/ppt/pptinanimations.cxx
+++ b/sd/source/filter/ppt/pptinanimations.cxx
@@ -48,6 +48,7 @@
 #include <com/sun/star/beans/NamedValue.hpp>
 #include <com/sun/star/container/XEnumerationAccess.hpp>
 #include <com/sun/star/drawing/XDrawPage.hpp>
+#include <com/sun/star/io/WrongFormatException.hpp>
 #include <com/sun/star/presentation/ParagraphTarget.hpp>
 #include <com/sun/star/presentation/TextAnimationType.hpp>
 #include <comphelper/processfactory.hxx>
@@ -2212,6 +2213,10 @@ void AnimationImporter::importAnimateKeyPoints( const Atom* pAtom, const Referen
             aKeyTimes[nKeyTime] = static_cast<double>(nKeyTime) / static_cast<double>(nKeyTimes - 1);
         }
     }
+
+    if (aValues.getLength() != aKeyTimes.getLength())
+        throw css::io::WrongFormatException();
+
     xAnim->setKeyTimes( aKeyTimes );
     xAnim->setValues( aValues );
     xAnim->setFormula( aFormula );
diff --git a/xmloff/source/draw/animationimport.cxx b/xmloff/source/draw/animationimport.cxx
index ebccff3d1a22..84d4407c8c8e 100644
--- a/xmloff/source/draw/animationimport.cxx
+++ b/xmloff/source/draw/animationimport.cxx
@@ -38,6 +38,7 @@
 #include <com/sun/star/animations/Timing.hpp>
 #include <com/sun/star/animations/Event.hpp>
 #include <com/sun/star/beans/XPropertySet.hpp>
+#include <com/sun/star/io/WrongFormatException.hpp>
 #include <com/sun/star/xml/sax/XFastAttributeList.hpp>
 #include <com/sun/star/text/XTextCursor.hpp>
 #include <com/sun/star/text/XTextRangeCompare.hpp>
@@ -1125,8 +1126,15 @@ void AnimationNodeContext::init_node(  const css::uno::Reference< css::xml::sax:
 
             if( !aValues.isEmpty() )
                 xAnimate->setValues( mpHelper->convertValueSequence( meAttributeName, aValues ) );
+
+            if (xAnimate->getValues().getLength() != xAnimate->getKeyTimes().getLength())
+                throw css::io::WrongFormatException();
         }
     }
+    catch (const css::io::WrongFormatException&)
+    {
+        throw;
+    }
     catch (const RuntimeException&)
     {
         OSL_FAIL( "xmloff::AnimationNodeContext::StartElement(), RuntimeException caught!" );