From 069e727e1049eaaeb1cbbd7fdd14d8d47abc1f8b Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Fri, 12 Jan 2018 20:44:25 +0000 Subject: ofz#5274 Out-of-memory Change-Id: I3e69f5e2be848933a43d09c620dafd946486e731 --- sd/source/filter/ppt/pptin.cxx | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) (limited to 'sd') diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx index 0b64546358d7..ef16cadef0d6 100644 --- a/sd/source/filter/ppt/pptin.cxx +++ b/sd/source/filter/ppt/pptin.cxx @@ -1953,15 +1953,21 @@ OUString ImplSdPPTImport::ReadSound(sal_uInt32 nSoundRef) const INetURLObject aGalleryUserSound( aGalleryDir.getToken( nTokenCount - 1, ';' ) ); aGalleryUserSound.Append( aRetval ); + const auto nRemainingSize = rStCtrl.remainingSize(); sal_uInt32 nSoundDataLen = aSoundDataRecHd.nRecLen; - std::unique_ptr pBuf( new sal_uInt8[ nSoundDataLen ] ); + if (nSoundDataLen > nRemainingSize) + { + SAL_WARN("filter.ms", "sound data len longer than remaining stream size"); + nSoundDataLen = nRemainingSize; + } + std::vector aBuf(nSoundDataLen); - rStCtrl.ReadBytes(pBuf.get(), nSoundDataLen); + rStCtrl.ReadBytes(aBuf.data(), nSoundDataLen); SvStream* pOStm = ::utl::UcbStreamHelper::CreateStream( aGalleryUserSound.GetMainURL( INetURLObject::DecodeMechanism::NONE ), StreamMode::WRITE | StreamMode::TRUNC ); if( pOStm ) { - pOStm->WriteBytes(pBuf.get(), nSoundDataLen); + pOStm->WriteBytes(aBuf.data(), nSoundDataLen); if( pOStm->GetError() == ERRCODE_NONE ) { -- cgit v1.2.3