From c8b76656c46d0d455393faec8d54f3a12c5ec617 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Thu, 7 Dec 2017 20:52:18 +0000
Subject: tdf#114304 break rather than return false on dodgy record length
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I1bc8c400147beb8688ed3afd7402b3d3f68a4a3a
Reviewed-on: https://gerrit.libreoffice.org/46044
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 filter/source/msfilter/msdffimp.cxx | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'filter')

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index 38d7e5ed9e8d..a90109396b45 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -6202,7 +6202,10 @@ bool SvxMSDffManager::GetShapeContainerData( SvStream& rSt,
         else
         {
             if (!checkSeek(rSt, rSt.Tell() + nLength))
-                return false;
+            {
+                SAL_WARN("filter.ms", "remaining record longer than available data, ppt or parser is wrong");
+                break;
+            }
             nReadSpCont += nLength;
         }
     }
-- 
cgit