fix crash on loading certain ppts

Change-Id: I544a67e3706c7d12414cc075118ef2f0f5ddd0f6

3 files changed, 10 insertions, 8 deletions

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index 47e9f35fb558..f5b79315cc29 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -4019,13 +4019,13 @@ PPTStyleSheet::PPTStyleSheet( const DffRecordHeader& rSlideHd, SvStream& rIn, Sd
             ReadDffRecordHeader( rIn, aTxMasterStyleHd );
             if ( aTxMasterStyleHd.nRecType == PPT_PST_TxMasterStyleAtom )
             {
-                sal_uInt16 nLevelAnz;
-                rIn.ReadUInt16( nLevelAnz );
+                sal_uInt16 nLevelAnz(0);
+                rIn.ReadUInt16(nLevelAnz);
 
                 sal_uInt16 nLev = 0;
                 bool bFirst = true;
                 bFoundTxMasterStyleAtom04 = true;
-                while ( rIn.GetError() == 0 && rIn.Tell() < aTxMasterStyleHd.GetRecEndFilePos() && nLev < nLevelAnz )
+                while (rIn.GetError() == 0 && rIn.Tell() < aTxMasterStyleHd.GetRecEndFilePos() && nLev < nLevelAnz && nLev < nMaxPPTLevels)
                 {
                     if ( nLev )
                     {
diff --git a/include/filter/msfilter/svdfppt.hxx b/include/filter/msfilter/svdfppt.hxx
index def0fd11b936..bfcea450f3d8 100644
--- a/include/filter/msfilter/svdfppt.hxx
+++ b/include/filter/msfilter/svdfppt.hxx
@@ -170,6 +170,8 @@ const sal_uInt32 PPTInventor = sal_uInt32('P') * 0x00000001
                              + sal_uInt32('T') * 0x00010000
                              + sal_uInt32('0') * 0x01000000;
 
+const int nMaxPPTLevels = 5;
+
 // Object IDs for StarDraw UserData
 #define PPT_OBJECTINFO_ID       (1)
 
@@ -705,7 +707,7 @@ struct PPTExtParaLevel
 
 struct PPTExtParaSheet
 {
-    PPTExtParaLevel aExtParaLevel[ 5 ];
+    PPTExtParaLevel aExtParaLevel[nMaxPPTLevels];
 };
 
 struct PPTBuGraEntry
@@ -750,7 +752,7 @@ struct PPTCharLevel
 
 struct PPTCharSheet
 {
-    PPTCharLevel    maCharLevel[ 5 ];
+    PPTCharLevel    maCharLevel[nMaxPPTLevels];
 
                     explicit PPTCharSheet( sal_uInt32 nInstance );
                     PPTCharSheet( const PPTCharSheet& rCharSheet );
@@ -783,7 +785,7 @@ struct PPTParaSheet
 {
 public:
 
-    PPTParaLevel    maParaLevel[ 5 ];
+    PPTParaLevel    maParaLevel[nMaxPPTLevels];
 
                     explicit PPTParaSheet( sal_uInt32 nInstance );
                     PPTParaSheet( const PPTParaSheet& rParaSheet );
@@ -988,8 +990,8 @@ struct PPTRuler
 
         sal_Int32           nFlags;
         sal_uInt16          nDefaultTab;
-        sal_uInt16          nTextOfs[ 5 ];
-        sal_uInt16          nBulletOfs[ 5 ];
+        sal_uInt16          nTextOfs[nMaxPPTLevels];
+        sal_uInt16          nBulletOfs[nMaxPPTLevels];
         PPTTabEntry*        pTab;
         sal_uInt16          nTabCount;
 
diff --git a/sd/qa/unit/data/ppt/pass/crash-1.ppt b/sd/qa/unit/data/ppt/pass/crash-1.ppt
new file mode 100644
index 000000000000..5d1a04b33cea
--- /dev/null
+++ b/sd/qa/unit/data/ppt/pass/crash-1.ppt