From 7af19f45b35c428d3e06972806e5a05489f45955 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 18 Sep 2015 13:20:03 +0100
Subject: check stream status and string lengths

Change-Id: I99f3d4a2ec760228f485d01fce856deb9c068431
---
 sd/source/filter/ppt/propread.cxx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'sd/source/filter/ppt')

diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx
index b76fbcaec5b4..03e05d0623bf 100644
--- a/sd/source/filter/ppt/propread.cxx
+++ b/sd/source/filter/ppt/propread.cxx
@@ -288,7 +288,9 @@ void Section::GetDictionary(Dictionary& rDict)
     for (sal_uInt32 i = 0; i < nDictCount; ++i)
     {
         sal_uInt32 nId(0), nSize(0);
-        aStream.ReadUInt32( nId ).ReadUInt32( nSize );
+        aStream.ReadUInt32(nId).ReadUInt32(nSize);
+        if (!aStream.good() || nSize > aStream.remainingSize())
+            break;
         if (mnTextEnc == RTL_TEXTENCODING_UCS2)
             nSize >>= 1;
         if (!nSize)
-- 
cgit v1.2.3