[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - filter/source sd/qa sd/source

[Caolán McNamara]

 filter/source/msfilter/svdfppt.cxx  |   18 +++++++++++++++---
 sd/qa/unit/data/ppt/pass/hang-9.ppt |binary
 sd/source/filter/ppt/pptin.cxx      |    8 +++++++-
 3 files changed, 22 insertions(+), 4 deletions(-)

New commits:
commit b59eea60468fcf8c1f304e58a0e96ed8afcc3a3f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 27 14:22:23 2015 +0100

    avoid loops in atom chains
    
    (cherry picked from commit de71eae5807ff94c8eace0eccaabf1ffa08e77b6)
    
    Change-Id: Icc40c0ee6c7d8d305cf7cc60cbf3e511c763aedd
    Reviewed-on: https://gerrit.libreoffice.org/18093
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index 1e8f49d..d3bb6b7 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -2552,11 +2552,17 @@ bool SdrPowerPointImport::GetColorFromPalette( sal_uInt16 nNum, Color& rColor )
                     while( ( pMasterPersist && pMasterPersist->aSlideAtom.nFlags & 2 )  // it is possible that a masterpage
                         && pMasterPersist->aSlideAtom.nMasterId )                        // itself is following a master colorscheme
                     {
-                        sal_uInt16 nNextMaster = pMasterPages->FindPage( pMasterPersist->aSlideAtom.nMasterId );
+                        auto nOrigMasterId = pMasterPersist->aSlideAtom.nMasterId;
+                        sal_uInt16 nNextMaster = pMasterPages->FindPage(nOrigMasterId);
                         if ( nNextMaster == PPTSLIDEPERSIST_ENTRY_NOTFOUND )
                             break;
                         else
                             pMasterPersist = &(*pPageList2)[ nNextMaster ];
+                        if (pMasterPersist->aSlideAtom.nMasterId == nOrigMasterId)
+                        {
+                            SAL_WARN("filter.ms", "loop in atom chain");
+                            break;
+                        }
                     }
                 }
                 if ( pMasterPersist )
@@ -2565,7 +2571,7 @@ bool SdrPowerPointImport::GetColorFromPalette( sal_uInt16 nNum, Color& rColor )
                 }
             }
         }
-        // resgister current color scheme
+        // register current color scheme
         const_cast<SdrPowerPointImport*>(this)->nPageColorsNum = nAktPageNum;
         const_cast<SdrPowerPointImport*>(this)->ePageColorsKind = eAktPageKind;
     }
@@ -2789,11 +2795,17 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet, const PptSlidePersistEntry*
                                             PptSlidePersistEntry* pE = &(*pPageList)[ nMasterNum ];
                                             while( ( pE->aSlideAtom.nFlags & 4 ) && pE->aSlideAtom.nMasterId )
                                             {
-                                                sal_uInt16 nNextMaster = pMasterPages->FindPage( pE->aSlideAtom.nMasterId );
+                                                auto nOrigMasterId = pE->aSlideAtom.nMasterId;
+                                                sal_uInt16 nNextMaster = pMasterPages->FindPage(nOrigMasterId);
                                                 if ( nNextMaster == PPTSLIDEPERSIST_ENTRY_NOTFOUND )
                                                     break;
                                                 else
                                                     pE = &(*pPageList)[ nNextMaster ];
+                                                if (pE->aSlideAtom.nMasterId == nOrigMasterId)
+                                                {
+                                                    SAL_WARN("filter.ms", "loop in atom chain");
+                                                    break;
+                                                }
                                             }
                                             if ( pE->nBackgroundOffset )
                                             {
diff --git a/sd/qa/unit/data/ppt/pass/hang-9.ppt b/sd/qa/unit/data/ppt/pass/hang-9.ppt
new file mode 100644
index 0000000..97e0158
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-9.ppt differ
diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx
index 8651c68..7565fd4 100644
--- a/sd/source/filter/ppt/pptin.cxx
+++ b/sd/source/filter/ppt/pptin.cxx
@@ -726,11 +726,17 @@ bool ImplSdPPTImport::Import()
                 PptSlidePersistEntry* pE = pPersist;
                 while( ( pE->aSlideAtom.nFlags & 4 ) && pE->aSlideAtom.nMasterId )
                 {
-                    sal_uInt16 nNextMaster = pMasterPages->FindPage( pE->aSlideAtom.nMasterId );
+                    auto nOrigMasterId = pE->aSlideAtom.nMasterId;
+                    sal_uInt16 nNextMaster = pMasterPages->FindPage(nOrigMasterId);
                     if ( nNextMaster == PPTSLIDEPERSIST_ENTRY_NOTFOUND )
                         break;
                     else
                         pE = &(*pList)[ nNextMaster ];
+                    if (pE->aSlideAtom.nMasterId == nOrigMasterId)
+                    {
+                        SAL_WARN("filter.ms", "loop in atom chain");
+                        break;
+                    }
                 }
                 SdrObject* pObj = ImportPageBackgroundObject( *pMPage, pE->nBackgroundOffset, true );   // import background
                 if ( pObj )