summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2017-10-21 16:59:19 +0100
committerCaolán McNamara <caolanm@redhat.com>2017-10-21 18:51:02 +0200
commit96976553c41e8e7af47ad3d25927f5018279f6c7 (patch)
tree2064a351379e373df36b18975c6e1ce31b793622
parentea6858c1e388c2d17a0825f3d21353ded67083eb (diff)
check ppt property size against max available len
Change-Id: Ie99a68ea34edfb480d41cf832d3044f4bf686585 Reviewed-on: https://gerrit.libreoffice.org/43661 Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com>
-rw-r--r--sd/source/filter/ppt/propread.cxx10
1 files changed, 8 insertions, 2 deletions
diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx
index ed1f9e4923d2..6854a7dc1a44 100644
--- a/sd/source/filter/ppt/propread.cxx
+++ b/sd/source/filter/ppt/propread.cxx
@@ -326,7 +326,13 @@ void Section::Read( SotStorageStream *pStrm )
mnTextEnc = RTL_TEXTENCODING_MS_1252;
sal_uInt32 nSecSize(0), nPropCount(0);
- pStrm->ReadUInt32( nSecSize ).ReadUInt32( nPropCount );
+ pStrm->ReadUInt32(nSecSize).ReadUInt32(nPropCount);
+ if (nSecSize > nStrmSize)
+ {
+ SAL_WARN("sd.filter", "Section Len " << nSecSize << " claimed, only " << nStrmSize << " possible");
+ nSecSize = nStrmSize;
+ }
+
while (nPropCount--)
{
sal_uInt32 nPropId(0), nPropOfs(0);
@@ -514,7 +520,7 @@ void Section::Read( SotStorageStream *pStrm )
}
pStrm->Seek(nCurrent);
}
- pStrm->Seek( nSecOfs + nSecSize );
+ pStrm->Seek(nSecOfs + nSecSize);
}
Section& Section::operator=( const Section& rSection )