diff options
Diffstat (limited to 'sd/source/filter/ppt/propread.cxx')
| -rw-r--r-- | sd/source/filter/ppt/propread.cxx | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx index 150acf381c4d..961c779a95a0 100644 --- a/sd/source/filter/ppt/propread.cxx +++ b/sd/source/filter/ppt/propread.cxx @@ -503,8 +503,12 @@ void Section::Read( SvStorageStream *pStrm ) break; case VT_LPWSTR : + { *pStrm >> nTemp; - nPropSize += ( nTemp << 1 ) + 4; + // looks like these are aligned to 4 bytes + sal_uInt32 nLength = nPropOfs + nSecOfs + nPropSize + ( nTemp << 1 ) + 4; + nPropSize += ( nTemp << 1 ) + 4 + (nLength % 4); + } break; case VT_BLOB_OBJECT : @@ -540,6 +544,9 @@ void Section::Read( SvStorageStream *pStrm ) break; } pStrm->Seek( nPropOfs + nSecOfs ); + // make sure we don't overflow the section size + if( nPropSize > nSecSize - nSecOfs ) + nPropSize = nSecSize - nSecOfs; sal_uInt8* pBuf = new sal_uInt8[ nPropSize ]; pStrm->Read( pBuf, nPropSize ); AddProperty( nPropId, pBuf, nPropSize ); |