[Libreoffice-commits] core.git: filter/source

[Steve Yin]

 filter/source/msfilter/escherex.cxx |    2 +-
 filter/source/msfilter/msdffimp.cxx |   26 ++++++++++++++------------
 2 files changed, 15 insertions(+), 13 deletions(-)

New commits:
commit b827f6f81f6a8f6d8046a278a18acb69e780afba
Author: Steve Yin <steve_y at apache.org>
Date:   Tue Apr 15 10:12:14 2014 +0000

    Related: #i124661# crash when loading and re-saving ppt file...
    
    with a single customshape
    
    check the equation array element number. If the number is greater than 128, the
    equation array will not be imported.
    
    (cherry picked from commit 48653aa3a1cc24ed9ad8a14ae035b38a751e561d)
    
    Conflicts:
    	filter/source/msfilter/msdffimp.cxx
    
    Change-Id: I49ac6ec5610a7761ca3ed4905d6fe1bc7ec079d0

diff --git a/filter/source/msfilter/escherex.cxx b/filter/source/msfilter/escherex.cxx
index 7e495db..db1473f 100644
--- a/filter/source/msfilter/escherex.cxx
+++ b/filter/source/msfilter/escherex.cxx
@@ -2582,7 +2582,7 @@ void ConvertEnhancedCustomShapeEquation( SdrObjCustomShape* pCustoShape,
         if ( pAny )
             *pAny >>= sEquationSource;
         sal_Int32 nEquationSourceCount = sEquationSource.getLength();
-        if ( nEquationSourceCount )
+        if ( nEquationSourceCount && (nEquationSourceCount <= 128) )
         {
             sal_Int32 i;
             for ( i = 0; i < nEquationSourceCount; i++ )
diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index d7d6ba8..eb2e91d 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -1866,20 +1866,22 @@ void DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
             sal_uInt16 nElemSize = 8;
             rIn.ReadUInt16( nNumElem ).ReadUInt16( nNumElemMem ).ReadUInt16( nElemSize );
         }
-        sal_Int16 nP1, nP2, nP3;
-        sal_uInt16 nFlags;
-
-        uno::Sequence< OUString > aEquations( nNumElem );
-        for ( sal_uInt16 i = 0; i < nNumElem; i++ )
+        if ( nNumElem <= 128 )
         {
-            rIn.ReadUInt16( nFlags ).ReadInt16( nP1 ).ReadInt16( nP2 ).ReadInt16( nP3 );
-            aEquations[ i ] = EnhancedCustomShape2d::GetEquation( nFlags, nP1, nP2, nP3 );
+            uno::Sequence< OUString > aEquations( nNumElem );
+            for ( sal_uInt16 i = 0; i < nNumElem; i++ )
+            {
+                sal_Int16 nP1(0), nP2(0), nP3(0);
+                sal_uInt16 nFlags(0);
+                rIn.ReadUInt16( nFlags ).ReadInt16( nP1 ).ReadInt16( nP2 ).ReadInt16( nP3 );
+                aEquations[ i ] = EnhancedCustomShape2d::GetEquation( nFlags, nP1, nP2, nP3 );
+            }
+            // pushing the whole Equations element
+            const OUString sEquations( "Equations" );
+            aProp.Name = sEquations;
+            aProp.Value <<= aEquations;
+            aPropVec.push_back( aProp );
         }
-        // pushing the whole Equations element
-        const OUString sEquations( "Equations" );
-        aProp.Name = sEquations;
-        aProp.Value <<= aEquations;
-        aPropVec.push_back( aProp );
     }