From 4d66989d1ebac53ff8b2af7d17642e3ab688a317 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Sun, 9 Apr 2017 18:51:31 +0100
Subject: ofz#1078 cgm infinite recurse

Change-Id: I6ba4c6a432f1dd150591f8d9b0f03e248a97c33e
---
 filter/source/graphicfilter/icgm/cgm.cxx | 13 ++++++++++++-
 filter/source/graphicfilter/icgm/cgm.hxx |  3 ++-
 2 files changed, 14 insertions(+), 2 deletions(-)

(limited to 'filter')

diff --git a/filter/source/graphicfilter/icgm/cgm.cxx b/filter/source/graphicfilter/icgm/cgm.cxx
index 714c4d73757e..d3669fe703d3 100644
--- a/filter/source/graphicfilter/icgm/cgm.cxx
+++ b/filter/source/graphicfilter/icgm/cgm.cxx
@@ -51,6 +51,7 @@ CGM::CGM(uno::Reference< frame::XModel > const & rModel)
     , mbPictureBody(false)
     , mbFigure(false)
     , mbFirstOutPut(false)
+    , mbInDefaultReplacement(false)
     , mnAct4PostReset(0)
     , mpBitmapInUse(nullptr)
     , mpChart(nullptr)
@@ -620,8 +621,16 @@ void CGM::ImplDoClass()
 
 void CGM::ImplDefaultReplacement()
 {
-    if ( !maDefRepList.empty() )
+    if (!maDefRepList.empty())
     {
+        if (mbInDefaultReplacement)
+        {
+            SAL_WARN("filter", "recursion in ImplDefaultReplacement");
+            return;
+        }
+
+        mbInDefaultReplacement = true;
+
         sal_uInt32  nOldEscape = mnEscape;
         sal_uInt32  nOldElementClass = mnElementClass;
         sal_uInt32  nOldElementID = mnElementID;
@@ -663,6 +672,8 @@ void CGM::ImplDefaultReplacement()
         mnParaSize = mnElementSize = nOldElementSize;
         mpSource = pOldBuf;
         mpEndValidSource = pOldEndValidSource;
+
+        mbInDefaultReplacement = false;
     }
 }
 
diff --git a/filter/source/graphicfilter/icgm/cgm.hxx b/filter/source/graphicfilter/icgm/cgm.hxx
index 4da49ea302de..a7c5d04d9d6d 100644
--- a/filter/source/graphicfilter/icgm/cgm.hxx
+++ b/filter/source/graphicfilter/icgm/cgm.hxx
@@ -64,7 +64,8 @@ class CGM
         bool                mbPictureBody;
         bool                mbFigure;
         bool                mbFirstOutPut;
-        sal_uInt32              mnAct4PostReset;
+        bool                mbInDefaultReplacement;
+        sal_uInt32          mnAct4PostReset;
         CGMBitmap*          mpBitmapInUse;
         CGMChart*           mpChart;                // if sal_True->"SHWSLIDEREC"
                                                     //  otherwise "BEGINPIC" commands
-- 
cgit