[Libreoffice-commits] core.git: Branch 'libreoffice-4-3' - sw/source

[Michael Stahl]

 sw/source/filter/ww8/rtfsdrexport.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 7a046ddda3d8c7b8b94c6825349c7c143aafda68
Author: Michael Stahl <mstahl at redhat.com>
Date:   Thu Feb 5 15:19:33 2015 +0100

    sw: fix ASAN detected error in RtfSdrExport::Commit()
    
    EscherPropertyContainer may allocate a 1-byte buffer if there are no
    vertices / segments. (happens in sw_filters_test)
    
     in EscherPropertyContainer::CreateCustomShapeProperties(MSO_SPT, com::sun::star::uno::Reference<com::sun::star::drawing::XShape> const&) filter/source/msfilter/escherex.cxx:3853:25
    
    Change-Id: I56dedbd57d38cd017183060e924cb1340ea58ebf
    (cherry picked from commit e73799f8a9310f04074bc0dd88d9092094338576)
    Reviewed-on: https://gerrit.libreoffice.org/14336
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/sw/source/filter/ww8/rtfsdrexport.cxx b/sw/source/filter/ww8/rtfsdrexport.cxx
index d8706a2..a6ac55c 100644
--- a/sw/source/filter/ww8/rtfsdrexport.cxx
+++ b/sw/source/filter/ww8/rtfsdrexport.cxx
@@ -259,7 +259,8 @@ void RtfSdrExport::Commit(EscherPropertyContainer& rProps, const Rectangle& rRec
             EscherPropSortStruct aSegments;
 
             if (rProps.GetOpt(ESCHER_Prop_pVertices, aVertices) &&
-                    rProps.GetOpt(ESCHER_Prop_pSegmentInfo, aSegments))
+                rProps.GetOpt(ESCHER_Prop_pSegmentInfo, aSegments) &&
+                aVertices.nPropSize >= 6 && aSegments.nPropSize >= 6)
             {
                 const sal_uInt8* pVerticesIt = aVertices.pBuf + 6;
                 sal_Size nVerticesPos = 6;