diff options
| author | Pranav Kant <pranavk@collabora.com> | 2016-02-20 23:45:24 +0530 |
|---|---|---|
| committer | Pranav Kant <pranavk@collabora.com> | 2016-02-21 22:08:10 +0530 |
| commit | 60b1fb6edb9aba1ac42d80697d73a9ee693ff45c (patch) | |
| tree | a492084a6f63f12f4addf1ab55b56fb0ef2a5afb /libreofficekit | |
| parent | 69c5252a63d6124a90b652c423dbf94d26fe196b (diff) | |
lokdocview: Protect set_part from setting an invalid part number
Change-Id: Iffbe71ab161d5c50a98fd17ee0fdd0ab4d065e9d
Diffstat (limited to 'libreofficekit')
| -rw-r--r-- | libreofficekit/source/gtk/lokdocview.cxx | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/libreofficekit/source/gtk/lokdocview.cxx b/libreofficekit/source/gtk/lokdocview.cxx index baa4f6e94327..059401a2b102 100644 --- a/libreofficekit/source/gtk/lokdocview.cxx +++ b/libreofficekit/source/gtk/lokdocview.cxx @@ -67,6 +67,8 @@ struct LOKDocViewPrivateImpl gboolean m_bEdit; /// LOK Features guint64 m_nLOKFeatures; + /// Number of parts in currently loaded document + gint m_nParts; /// Position and size of the visible cursor. GdkRectangle m_aVisibleCursor; /// Cursor overlay is visible or hidden (for blinking). @@ -825,6 +827,7 @@ static gboolean postDocumentLoad(gpointer pData) priv->m_pDocument->pClass->initializeForRendering(priv->m_pDocument, priv->m_aRenderingArguments.c_str()); priv->m_pDocument->pClass->registerCallback(priv->m_pDocument, callbackWorker, pLOKDocView); priv->m_pDocument->pClass->getDocumentSize(priv->m_pDocument, &priv->m_nDocumentWidthTwips, &priv->m_nDocumentHeightTwips); + priv->m_nParts = priv->m_pDocument->pClass->getParts(priv->m_pDocument); g_timeout_add(600, handleTimeout, pLOKDocView); float zoom = priv->m_fZoom; @@ -2759,6 +2762,12 @@ lok_doc_view_set_part (LOKDocView* pDocView, int nPart) if (!priv->m_pDocument) return; + if (nPart < 0 || nPart >= priv->m_nParts) + { + g_warning("Invalid part request : %d", nPart); + return; + } + GTask* task = g_task_new(pDocView, nullptr, nullptr, nullptr); LOEvent* pLOEvent = new LOEvent(LOK_SET_PART); GError* error = nullptr; |