diff options
| -rw-r--r-- | filter/source/msfilter/svdfppt.cxx | 6 | ||||
| -rw-r--r-- | include/filter/msfilter/svdfppt.hxx | 12 | ||||
| -rw-r--r-- | sd/qa/unit/data/ppt/pass/crash-1.ppt | bin | 0 -> 7677 bytes |
3 files changed, 10 insertions, 8 deletions
diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx index 47e9f35fb558..f5b79315cc29 100644 --- a/filter/source/msfilter/svdfppt.cxx +++ b/filter/source/msfilter/svdfppt.cxx @@ -4019,13 +4019,13 @@ PPTStyleSheet::PPTStyleSheet( const DffRecordHeader& rSlideHd, SvStream& rIn, Sd ReadDffRecordHeader( rIn, aTxMasterStyleHd ); if ( aTxMasterStyleHd.nRecType == PPT_PST_TxMasterStyleAtom ) { - sal_uInt16 nLevelAnz; - rIn.ReadUInt16( nLevelAnz ); + sal_uInt16 nLevelAnz(0); + rIn.ReadUInt16(nLevelAnz); sal_uInt16 nLev = 0; bool bFirst = true; bFoundTxMasterStyleAtom04 = true; - while ( rIn.GetError() == 0 && rIn.Tell() < aTxMasterStyleHd.GetRecEndFilePos() && nLev < nLevelAnz ) + while (rIn.GetError() == 0 && rIn.Tell() < aTxMasterStyleHd.GetRecEndFilePos() && nLev < nLevelAnz && nLev < nMaxPPTLevels) { if ( nLev ) { diff --git a/include/filter/msfilter/svdfppt.hxx b/include/filter/msfilter/svdfppt.hxx index def0fd11b936..bfcea450f3d8 100644 --- a/include/filter/msfilter/svdfppt.hxx +++ b/include/filter/msfilter/svdfppt.hxx @@ -170,6 +170,8 @@ const sal_uInt32 PPTInventor = sal_uInt32('P') * 0x00000001 + sal_uInt32('T') * 0x00010000 + sal_uInt32('0') * 0x01000000; +const int nMaxPPTLevels = 5; + // Object IDs for StarDraw UserData #define PPT_OBJECTINFO_ID (1) @@ -705,7 +707,7 @@ struct PPTExtParaLevel struct PPTExtParaSheet { - PPTExtParaLevel aExtParaLevel[ 5 ]; + PPTExtParaLevel aExtParaLevel[nMaxPPTLevels]; }; struct PPTBuGraEntry @@ -750,7 +752,7 @@ struct PPTCharLevel struct PPTCharSheet { - PPTCharLevel maCharLevel[ 5 ]; + PPTCharLevel maCharLevel[nMaxPPTLevels]; explicit PPTCharSheet( sal_uInt32 nInstance ); PPTCharSheet( const PPTCharSheet& rCharSheet ); @@ -783,7 +785,7 @@ struct PPTParaSheet { public: - PPTParaLevel maParaLevel[ 5 ]; + PPTParaLevel maParaLevel[nMaxPPTLevels]; explicit PPTParaSheet( sal_uInt32 nInstance ); PPTParaSheet( const PPTParaSheet& rParaSheet ); @@ -988,8 +990,8 @@ struct PPTRuler sal_Int32 nFlags; sal_uInt16 nDefaultTab; - sal_uInt16 nTextOfs[ 5 ]; - sal_uInt16 nBulletOfs[ 5 ]; + sal_uInt16 nTextOfs[nMaxPPTLevels]; + sal_uInt16 nBulletOfs[nMaxPPTLevels]; PPTTabEntry* pTab; sal_uInt16 nTabCount; diff --git a/sd/qa/unit/data/ppt/pass/crash-1.ppt b/sd/qa/unit/data/ppt/pass/crash-1.ppt Binary files differnew file mode 100644 index 000000000000..5d1a04b33cea --- /dev/null +++ b/sd/qa/unit/data/ppt/pass/crash-1.ppt |