diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-08-27 20:32:28 +0100 |
|---|---|---|
| committer | David Tardon <dtardon@redhat.com> | 2015-08-28 10:58:49 +0000 |
| commit | 2ddf5ff569ef528d25df7b4613430ab93c207b7a (patch) | |
| tree | 9336c2859e9fafae4fce5fdc5c59261f585a1eda /filter | |
| parent | 6e0029ee903ebcf97b331908d537f40fde512478 (diff) | |
check seeks and offsets
Change-Id: I2b6ded138b9101415fc49e93e1ec3ebcd3a9d2ae
(cherry picked from commit 5ed690a3e8a575784ca25048e0229ebc52e6fccd)
Reviewed-on: https://gerrit.libreoffice.org/18099
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/msfilter/svdfppt.cxx | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx index 428708af4878..1e8f49d7fac3 100644 --- a/filter/source/msfilter/svdfppt.cxx +++ b/filter/source/msfilter/svdfppt.cxx @@ -6508,10 +6508,12 @@ PPTTextObj::PPTTextObj( SvStream& rIn, SdrPowerPointImport& rSdrPowerPointImport bStatus = false; else { - rIn.Seek( pE->nSlidePersistStartOffset ); + auto nOffset(pE->nSlidePersistStartOffset); + bStatus = (nOffset == rIn.Seek(nOffset)); // now we got the right page and are searching for the right // TextHeaderAtom - while ( rIn.Tell() < pE->nSlidePersistEndOffset ) + auto nEndRecPos = DffPropSet::SanitizeEndPos(rIn, pE->nSlidePersistEndOffset); + while (bStatus && rIn.Tell() < nEndRecPos) { ReadDffRecordHeader( rIn, aClientTextBoxHd ); if ( aClientTextBoxHd.nRecType == PPT_PST_TextHeaderAtom ) @@ -6522,7 +6524,8 @@ PPTTextObj::PPTTextObj( SvStream& rIn, SdrPowerPointImport& rSdrPowerPointImport break; } } - aClientTextBoxHd.SeekToEndOfRecord( rIn ); + if (!aClientTextBoxHd.SeekToEndOfRecord(rIn)) + break; } if ( rIn.Tell() > pE->nSlidePersistEndOffset ) bStatus = false; @@ -6535,12 +6538,14 @@ PPTTextObj::PPTTextObj( SvStream& rIn, SdrPowerPointImport& rSdrPowerPointImport // we have to calculate the correct record len DffRecordHeader aTmpHd; - while ( rIn.Tell() < pE->nSlidePersistEndOffset ) + nEndRecPos = DffPropSet::SanitizeEndPos(rIn, pE->nSlidePersistEndOffset); + while (rIn.Tell() < nEndRecPos) { ReadDffRecordHeader( rIn, aTmpHd ); if ( ( aTmpHd.nRecType == PPT_PST_SlidePersistAtom ) || ( aTmpHd.nRecType == PPT_PST_TextHeaderAtom ) ) break; - aTmpHd.SeekToEndOfRecord( rIn ); + if (!aTmpHd.SeekToEndOfRecord(rIn)) + break; aClientTextBoxHd.nRecLen += aTmpHd.nRecLen + DFF_COMMON_RECORD_HEADER_SIZE; } aClientTextBoxHd.SeekToContent( rIn ); |