diff options
| author | Kurt Zenker <kz@openoffice.org> | 2010-11-23 16:56:24 +0100 |
|---|---|---|
| committer | Kurt Zenker <kz@openoffice.org> | 2010-11-23 16:56:24 +0100 |
| commit | 04950a878291e95b1a4892856c2217cba5858259 (patch) | |
| tree | edecab5325892459de1f1f10565f9f0fcb732cf2 | |
| parent | 0975085ee0237894b1011001fe513090e974babc (diff) | |
| parent | f40a4108f21c4909061ee8c4db252dbc77ac933b (diff) | |
CWS-TOOLING: integrate CWS os145ooo/OOO330_m17
| -rw-r--r-- | filter/source/msfilter/svdfppt.cxx | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx index bd2292051..46a4881f1 100644 --- a/filter/source/msfilter/svdfppt.cxx +++ b/filter/source/msfilter/svdfppt.cxx @@ -1468,12 +1468,16 @@ SdrPowerPointImport::SdrPowerPointImport( PowerPointImportParam& rParam, const S if ( bOk ) { - // PersistPtrs lesen (alle) - nPersistPtrAnz = aUserEditAtom.nMaxPersistWritten + 1; // 1 mehr, damit ich immer direkt indizieren kann - pPersistPtr = new UINT32[ nPersistPtrAnz ]; // (die fangen naemlich eigentlich bei 1 an) + nPersistPtrAnz = aUserEditAtom.nMaxPersistWritten + 1; + if ( ( nPersistPtrAnz >> 2 ) > nStreamLen ) // sj: at least nPersistPtrAnz is not allowed to be greater than filesize + bOk = FALSE; // (it should not be greater than the PPT_PST_PersistPtrIncrementalBlock, but + // we are reading this block later, so we do not have access yet) + + if ( bOk && ( nPersistPtrAnz < ( SAL_MAX_UINT32 / sizeof( UINT32 ) ) ) ) + pPersistPtr = new (std::nothrow) UINT32[ nPersistPtrAnz ]; if ( !pPersistPtr ) bOk = FALSE; - else + if ( bOk ) { memset( pPersistPtr, 0x00, nPersistPtrAnz * 4 ); @@ -5087,8 +5091,8 @@ void PPTStyleTextPropReader::ReadParaProps( SvStream& rIn, SdrPowerPointImport& rIn >> nCharCount >> aParaPropSet.pParaSet->mnDepth; // Einruecktiefe - aParaPropSet.pParaSet->mnDepth = - std::min(sal_uInt16(9), + aParaPropSet.pParaSet->mnDepth = // taking care of about using not more than 9 outliner levels + std::min(sal_uInt16(8), aParaPropSet.pParaSet->mnDepth); nCharCount--; |