ofz: stack-overflow with infinite parse recursion

Change-Id: I4973875797446e146cbda6db84958c9e4962aa8b
Reviewed-on: https://gerrit.libreoffice.org/35545
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 8 insertions, 1 deletions

diff --git a/svx/source/customshapes/EnhancedCustomShapeFunctionParser.cxx b/svx/source/customshapes/EnhancedCustomShapeFunctionParser.cxx
index 45f1d786f3d3..fbded8d9e32b 100644
--- a/svx/source/customshapes/EnhancedCustomShapeFunctionParser.cxx
+++ b/svx/source/customshapes/EnhancedCustomShapeFunctionParser.cxx
@@ -178,17 +178,24 @@ class EquationExpression : public ExpressionNode
 {
     sal_Int32                       mnIndex;
     const EnhancedCustomShape2d&    mrCustoShape;
+    mutable bool                    mbGettingValueGuard;
 
 public:
 
     EquationExpression( const EnhancedCustomShape2d& rCustoShape, sal_Int32 nIndex )
         : mnIndex       ( nIndex )
         , mrCustoShape( rCustoShape )
+        , mbGettingValueGuard(false)
     {
     }
     virtual double operator()() const override
     {
-        return mrCustoShape.GetEquationValueAsDouble( mnIndex );
+        if (mbGettingValueGuard)
+            throw ParseError("Loop in Expression");
+        mbGettingValueGuard = true;
+        double fRet = mrCustoShape.GetEquationValueAsDouble(mnIndex);
+        mbGettingValueGuard = false;
+        return fRet;
     }
     virtual bool isConstant() const override
     {