diff options
| author | Jan Holesovsky <kendy@suse.cz> | 2011-05-31 10:45:47 +0200 |
|---|---|---|
| committer | Jan Holesovsky <kendy@suse.cz> | 2011-05-31 10:45:47 +0200 |
| commit | 44863c2f2fd78c291092037aaf0d7abfa21f773d (patch) | |
| tree | e37ec8eadc355883b61f7aef84cfbe9b5f5fa642 /sd/source/filter/ppt/propread.cxx | |
| parent | 98c355692e3479f86fccb05e99170c5ccc56aeba (diff) | |
| parent | e95ca98b9aaf2399200566373a25a572a43307f4 (diff) | |
Merge commit 'libreoffice-3.4.0.2'
Conflicts:
sd/prj/d.lst
sd/source/ui/dlg/sdabstdlg.cxx
sd/util/makefile.mk
Diffstat (limited to 'sd/source/filter/ppt/propread.cxx')
| -rw-r--r-- | sd/source/filter/ppt/propread.cxx | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx index 6b6998158be7..291cf2c1e300 100644 --- a/sd/source/filter/ppt/propread.cxx +++ b/sd/source/filter/ppt/propread.cxx @@ -411,8 +411,12 @@ void Section::Read( SvStorageStream *pStrm ) break; case VT_LPWSTR : + { *pStrm >> nTemp; - nPropSize += ( nTemp << 1 ) + 4; + // looks like these are aligned to 4 bytes + sal_uInt32 nLength = nPropOfs + nSecOfs + nPropSize + ( nTemp << 1 ) + 4; + nPropSize += ( nTemp << 1 ) + 4 + (nLength % 4); + } break; case VT_BLOB_OBJECT : @@ -448,6 +452,9 @@ void Section::Read( SvStorageStream *pStrm ) break; } pStrm->Seek( nPropOfs + nSecOfs ); + // make sure we don't overflow the section size + if( nPropSize > nSecSize - nSecOfs ) + nPropSize = nSecSize - nSecOfs; sal_uInt8* pBuf = new sal_uInt8[ nPropSize ]; pStrm->Read( pBuf, nPropSize ); AddProperty( nPropId, pBuf, nPropSize ); |