diff options
| author | Julien Nabet <serval2412@yahoo.fr> | 2014-05-24 16:35:49 +0200 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-05-25 14:30:23 -0500 |
| commit | 5a1a182f626bd9caa077e20850a132759fec5d86 (patch) | |
| tree | 3cdb9898aa6ad10a3961b0ce32ad6947cd94123a | |
| parent | 8de2b492b1344f832fd118be22aaab9947bec865 (diff) | |
Resolves: fdo#79137 Crash in oox::vml::InputStream::updateBuffer
bt shows:
Program received signal SIGSEGV, Segmentation fault.
0x00002aaadba213fb in oox::vml::InputStream::updateBuffer (this=0x8d7fd80) at /home/julien/compile-libreoffice/libreoffice/oox/source/vml/vmlinputstream.cxx:339
339 while( (mnBufferPos >= maBuffer.getLength()) && !mxTextStrm->isEOF() )
(gdb) bt
0x00002aaadba213fb in oox::vml::InputStream::updateBuffer (this=0x8d7fd80) at /home/julien/compile-libreoffice/libreoffice/oox/source/vml/vmlinputstream.cxx:339
0x00002aaadba21048 in oox::vml::InputStream::available (this=0x8d7fd80) at /home/julien/compile-libreoffice/libreoffice/oox/source/vml/vmlinputstream.cxx:326
0x00002aaacf5a0249 in sax_fastparser::FastSaxParserImpl::parseStream (this=0x89aea30, maStructSource=...)
at /home/julien/compile-libreoffice/libreoffice/sax/source/fastparser/fastparser.cxx:810
Indeed, mxTextStrm is invalid, so let's test its validity in InputStream constructor
Cherry-picked from 372d5d74ad8cfb9b69dc20557359c4a2c1597b57
Change-Id: Ifed79603e33b64d11eb07656df17824b7f98058f
Reviewed-on: https://gerrit.libreoffice.org/9466
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | oox/source/vml/vmlinputstream.cxx | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/oox/source/vml/vmlinputstream.cxx b/oox/source/vml/vmlinputstream.cxx index 48d0a3c42987..34336a5dcaca 100644 --- a/oox/source/vml/vmlinputstream.cxx +++ b/oox/source/vml/vmlinputstream.cxx @@ -266,6 +266,8 @@ InputStream::InputStream( const Reference< XComponentContext >& rxContext, const maClosingCData( CREATE_OSTRING( "]]>" ) ), mnBufferPos( 0 ) { + if (!mxTextStrm.is()) + throw IOException(); maOpeningBracket[ 0 ] = '<'; maClosingBracket[ 0 ] = '>'; } |