[Libreoffice-commits] core.git: Branch 'libreoffice-4-1' - filter/source

[Caolán McNamara]

 filter/source/msfilter/svdfppt.cxx |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

New commits:
commit cda1335e227ce7b3c9e1a1514546deeda26ee396
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Sep 5 12:57:59 2013 +0100

    CID#1078757 nOfs <= nPersistPtrAnz
    
    Change-Id: Icf2729a4a7f8476d71d4609e060d3da2d172e7a8
    (cherry picked from commit a46fade2c1c7ea29ff7553d5d10afbf813839af1)
    Reviewed-on: https://gerrit.libreoffice.org/5891
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index 0a8065a..5c638b8 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -1319,13 +1319,13 @@ SdrPowerPointImport::SdrPowerPointImport( PowerPointImportParam& rParam, const O
             bOk = sal_False;                                // (it should not be greater than the PPT_PST_PersistPtrIncrementalBlock, but
                                                         // we are reading this block later, so we do not have access yet)
 
-        if ( bOk && ( nPersistPtrAnz < ( SAL_MAX_UINT32 / sizeof( sal_uInt32 ) ) ) )
-            pPersistPtr = new (std::nothrow) sal_uInt32[ nPersistPtrAnz ];
+        if ( bOk && ( nPersistPtrAnz < ( SAL_MAX_UINT32 / sizeof( sal_uInt32 ) ) -1 ) )
+            pPersistPtr = new (std::nothrow) sal_uInt32[ nPersistPtrAnz + 1 ];
         if ( !pPersistPtr )
             bOk = sal_False;
         if ( bOk )
         {
-            memset( pPersistPtr, 0x00, nPersistPtrAnz * 4 );
+            memset( pPersistPtr, 0x00, (nPersistPtrAnz+1) * sizeof(sal_uInt32) );
 
             // SJ: new search mechanism from bottom to top (Issue 21122)
             PptUserEditAtom aCurrentEditAtom( aUserEditAtom );
@@ -1343,14 +1343,14 @@ SdrPowerPointImport::SdrPowerPointImport( PowerPointImportParam& rParam, const O
                         sal_uLong nPibLen = aPersistHd.GetRecEndFilePos();
                         while ( bOk && ( rStCtrl.GetError() == 0 ) && ( rStCtrl.Tell() < nPibLen ) )
                         {
-                            sal_uInt32 nOfs, nAnz;
+                            sal_uInt32 nOfs(0);
                             rStCtrl >> nOfs;
-                            nAnz = nOfs;
+                            sal_uInt32 nAnz = nOfs;
                             nOfs &= 0x000FFFFF;
                             nAnz >>= 20;
                             while ( bOk && ( rStCtrl.GetError() == 0 ) && ( nAnz > 0 ) && ( nOfs <= nPersistPtrAnz ) )
                             {
-                                sal_uInt32 nPt;
+                                sal_uInt32 nPt(0);
                                 rStCtrl >> nPt;
                                 if ( !pPersistPtr[ nOfs ] )
                                 {