diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2019-01-11 11:18:18 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2019-01-11 15:55:46 +0100 |
| commit | 8ae5d297d46c79a73a02c856417804c371a711ac (patch) | |
| tree | 9e7930a48b86b3b336568beabf77b969f8e1dad4 /sd | |
| parent | 1a8b2c1b18b1fdf1bc598ad8c2556fa0e4183606 (diff) | |
ofz#11243 timeout with bogus length
Change-Id: I707f31b704ed6e67183bdbd60ea1c1cc126dac09
Reviewed-on: https://gerrit.libreoffice.org/66161
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'sd')
| -rw-r--r-- | sd/source/filter/ppt/pptin.cxx | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx index 066b8ef203e0..12887386c583 100644 --- a/sd/source/filter/ppt/pptin.cxx +++ b/sd/source/filter/ppt/pptin.cxx @@ -1297,7 +1297,15 @@ bool ImplSdPPTImport::Import() if ( SeekToRec( rStCtrl, PPT_PST_NamedShowSlides, aCuHeader.GetRecEndFilePos(), &aContent ) ) { PptSlidePersistList* pPageList = GetPageList( PPT_SLIDEPAGE ); - sal_uInt32 nSCount = aContent.nRecLen >> 2; + const auto nRemainingSize = rStCtrl.remainingSize(); + sal_uInt32 nBCount = aContent.nRecLen; + if (nBCount > nRemainingSize) + { + SAL_WARN("filter.ms", "page number data len longer than remaining stream size"); + nBCount = nRemainingSize; + } + sal_uInt32 nSCount = nBCount >> 2; + if ( pPageList && nSCount ) { SdCustomShowList* pList = mpDoc->GetCustomShowList( true ); |