[Libreoffice-commits] core.git: Branch 'libreoffice-4-3' - oox/source

[Julien Nabet]

 oox/source/vml/vmlinputstream.cxx |    2 ++
 1 file changed, 2 insertions(+)

New commits:
commit 38365bf44e7ea37d25463787baab83e985240a41
Author: Julien Nabet <serval2412 at yahoo.fr>
Date:   Sat May 24 16:35:49 2014 +0200

    Resolves: fdo#79137 Crash in oox::vml::InputStream::updateBuffer
    
    bt shows:
    Program received signal SIGSEGV, Segmentation fault.
    0x00002aaadba213fb in oox::vml::InputStream::updateBuffer (this=0x8d7fd80) at /home/julien/compile-libreoffice/libreoffice/oox/source/vml/vmlinputstream.cxx:339
    339	    while( (mnBufferPos >= maBuffer.getLength()) && !mxTextStrm->isEOF() )
    (gdb) bt
    0x00002aaadba213fb in oox::vml::InputStream::updateBuffer (this=0x8d7fd80) at /home/julien/compile-libreoffice/libreoffice/oox/source/vml/vmlinputstream.cxx:339
    0x00002aaadba21048 in oox::vml::InputStream::available (this=0x8d7fd80) at /home/julien/compile-libreoffice/libreoffice/oox/source/vml/vmlinputstream.cxx:326
    0x00002aaacf5a0249 in sax_fastparser::FastSaxParserImpl::parseStream (this=0x89aea30, maStructSource=...)
    at /home/julien/compile-libreoffice/libreoffice/sax/source/fastparser/fastparser.cxx:810
    
    Indeed, mxTextStrm is invalid, so let's test its validity in InputStream constructor
    
    Cherry-picked from 372d5d74ad8cfb9b69dc20557359c4a2c1597b57
    
    Change-Id: Ifed79603e33b64d11eb07656df17824b7f98058f
    Reviewed-on: https://gerrit.libreoffice.org/9465
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/oox/source/vml/vmlinputstream.cxx b/oox/source/vml/vmlinputstream.cxx
index 70896e1..f373bad0 100644
--- a/oox/source/vml/vmlinputstream.cxx
+++ b/oox/source/vml/vmlinputstream.cxx
@@ -266,6 +266,8 @@ InputStream::InputStream( const Reference< XComponentContext >& rxContext, const
     maClosingCData( CREATE_OSTRING( "]]>" ) ),
     mnBufferPos( 0 )
 {
+    if (!mxTextStrm.is())
+        throw IOException();
     maOpeningBracket[ 0 ] = '<';
     maClosingBracket[ 0 ] = '>';
 }