diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-12-10 11:29:32 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-12-10 16:25:19 +0100 |
| commit | 0ecd8c5fe38b039fb15227a21938884f633c0c78 (patch) | |
| tree | 25879633df52c6663595b427c9ed12bbb8d0d8b6 /starmath | |
| parent | 01b64e5f5e3658810c7e66c6577705764ef7e288 (diff) | |
ofz#4570 depth protect mathtype parsing
Change-Id: I1d8ca1704c057e154aa1d3aa57d722c24609cc48
Reviewed-on: https://gerrit.libreoffice.org/46181
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'starmath')
| -rw-r--r-- | starmath/source/mathtype.cxx | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/starmath/source/mathtype.cxx b/starmath/source/mathtype.cxx index 68e87a3db7de..c7016656a3e1 100644 --- a/starmath/source/mathtype.cxx +++ b/starmath/source/mathtype.cxx @@ -646,6 +646,10 @@ void MathType::HandleNudge() bool MathType::HandleRecords(int nLevel, sal_uInt8 nSelector, sal_uInt8 nVariation, int nMatrixRows, int nMatrixCols) { + //depth-protect + if (nLevel > 2048) + return false; + sal_uInt8 nTag,nRecord; sal_uInt8 nTabType,nTabStops; sal_uInt16 nTabOffset; |