diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-08-29 20:26:27 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-08-29 20:26:27 +0100 |
| commit | 452cd9e75de657e996e17510fe5d3539065489d1 (patch) | |
| tree | e9959744014a19049cc7da81a8aaa0464a1f5fdd /sd | |
| parent | 723b32783f8c411d410242639d9dbd0cadc61c43 (diff) | |
check stream status
Change-Id: I6b9537cf94ac1c5d996ba64ddf878745dadde254
Diffstat (limited to 'sd')
| -rw-r--r-- | sd/qa/unit/data/ppt/pass/hang-21.ppt | bin | 0 -> 7659 bytes | |||
| -rw-r--r-- | sd/source/filter/ppt/propread.cxx | 8 |
2 files changed, 8 insertions, 0 deletions
diff --git a/sd/qa/unit/data/ppt/pass/hang-21.ppt b/sd/qa/unit/data/ppt/pass/hang-21.ppt Binary files differnew file mode 100644 index 000000000000..99cf49f8d1e5 --- /dev/null +++ b/sd/qa/unit/data/ppt/pass/hang-21.ppt diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx index 18f345039dd0..5454c562e69a 100644 --- a/sd/source/filter/ppt/propread.cxx +++ b/sd/source/filter/ppt/propread.cxx @@ -497,10 +497,18 @@ void Section::Read( SotStorageStream *pStrm ) { sal_uInt32 nDictCount(0); pStrm->ReadUInt32(nDictCount); + auto nMaxRecordsPossible = pStrm->remainingSize() / (sizeof(sal_uInt32)*2); + if (nDictCount > nMaxRecordsPossible) + { + SAL_WARN("sd.filter", "Dictionary count of " << nDictCount << " claimed, only " << nMaxRecordsPossible << " possible"); + nDictCount = nMaxRecordsPossible; + } for (sal_uInt32 i = 0; i < nDictCount; ++i) { sal_uInt32 nSize(0); pStrm->ReadUInt32( nSize ).ReadUInt32( nSize ); + if (!pStrm->good()) + break; sal_uInt64 nPos = pStrm->Tell() + nSize; if (nPos != pStrm->Seek(nPos)) break; |