diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-01-12 20:44:25 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-01-12 21:06:13 +0000 |
| commit | 069e727e1049eaaeb1cbbd7fdd14d8d47abc1f8b (patch) | |
| tree | f20abc27b9ef951f551be196db60c29bd7a3ab76 /sd | |
| parent | a746f20cae91a87b8263342fb558a12f2f0d50b2 (diff) | |
ofz#5274 Out-of-memory
Change-Id: I3e69f5e2be848933a43d09c620dafd946486e731
Diffstat (limited to 'sd')
| -rw-r--r-- | sd/source/filter/ppt/pptin.cxx | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx index 0b64546358d7..ef16cadef0d6 100644 --- a/sd/source/filter/ppt/pptin.cxx +++ b/sd/source/filter/ppt/pptin.cxx @@ -1953,15 +1953,21 @@ OUString ImplSdPPTImport::ReadSound(sal_uInt32 nSoundRef) const INetURLObject aGalleryUserSound( aGalleryDir.getToken( nTokenCount - 1, ';' ) ); aGalleryUserSound.Append( aRetval ); + const auto nRemainingSize = rStCtrl.remainingSize(); sal_uInt32 nSoundDataLen = aSoundDataRecHd.nRecLen; - std::unique_ptr<sal_uInt8[]> pBuf( new sal_uInt8[ nSoundDataLen ] ); + if (nSoundDataLen > nRemainingSize) + { + SAL_WARN("filter.ms", "sound data len longer than remaining stream size"); + nSoundDataLen = nRemainingSize; + } + std::vector<sal_uInt8> aBuf(nSoundDataLen); - rStCtrl.ReadBytes(pBuf.get(), nSoundDataLen); + rStCtrl.ReadBytes(aBuf.data(), nSoundDataLen); SvStream* pOStm = ::utl::UcbStreamHelper::CreateStream( aGalleryUserSound.GetMainURL( INetURLObject::DecodeMechanism::NONE ), StreamMode::WRITE | StreamMode::TRUNC ); if( pOStm ) { - pOStm->WriteBytes(pBuf.get(), nSoundDataLen); + pOStm->WriteBytes(aBuf.data(), nSoundDataLen); if( pOStm->GetError() == ERRCODE_NONE ) { |