[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source sd/qa sd/source

[Caolán McNamara]

 filter/source/msfilter/svdfppt.cxx  |   22 +++++++++++++++++-----
 sd/qa/unit/data/ppt/pass/hang-9.ppt |binary
 sd/source/filter/ppt/pptin.cxx      |    8 +++++++-
 3 files changed, 24 insertions(+), 6 deletions(-)

New commits:
commit f6e85ec2eb9263e804098aeade75bd9fe8f39b27
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 27 14:22:23 2015 +0100

    avoid loops in atom chains
    
    (cherry picked from commit de71eae5807ff94c8eace0eccaabf1ffa08e77b6)
    
    Change-Id: Icc40c0ee6c7d8d305cf7cc60cbf3e511c763aedd
    Reviewed-on: https://gerrit.libreoffice.org/18080
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index 9a5ca61..b6693086 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -2541,11 +2541,17 @@ bool SdrPowerPointImport::GetColorFromPalette( sal_uInt16 nNum, Color& rColor )
                     while( ( pMasterPersist && pMasterPersist->aSlideAtom.nFlags & 2 )  // it is possible that a masterpage
                         && pMasterPersist->aSlideAtom.nMasterId )                        // itself is following a master colorscheme
                     {
-                        sal_uInt16 nNextMaster = pMasterPages->FindPage( pMasterPersist->aSlideAtom.nMasterId );
+                        auto nOrigMasterId = pMasterPersist->aSlideAtom.nMasterId;
+                        sal_uInt16 nNextMaster = pMasterPages->FindPage(nOrigMasterId);
                         if ( nNextMaster == PPTSLIDEPERSIST_ENTRY_NOTFOUND )
                             break;
                         else
                             pMasterPersist = &(*pPageList2)[ nNextMaster ];
+                        if (pMasterPersist->aSlideAtom.nMasterId == nOrigMasterId)
+                        {
+                            SAL_WARN("filter.ms", "loop in atom chain");
+                            break;
+                        }
                     }
                 }
                 if ( pMasterPersist )
@@ -2554,9 +2560,9 @@ bool SdrPowerPointImport::GetColorFromPalette( sal_uInt16 nNum, Color& rColor )
                 }
             }
         }
-        // resgister current color scheme
-        ((SdrPowerPointImport*)this)->nPageColorsNum = nAktPageNum;
-        ((SdrPowerPointImport*)this)->ePageColorsKind = eAktPageKind;
+        // register current color scheme
+        const_cast<SdrPowerPointImport*>(this)->nPageColorsNum = nAktPageNum;
+        const_cast<SdrPowerPointImport*>(this)->ePageColorsKind = eAktPageKind;
     }
     rColor = aPageColors.GetColor( nNum );
     return true;
@@ -2778,11 +2784,17 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet, const PptSlidePersistEntry*
                                             PptSlidePersistEntry* pE = &(*pPageList)[ nMasterNum ];
                                             while( ( pE->aSlideAtom.nFlags & 4 ) && pE->aSlideAtom.nMasterId )
                                             {
-                                                sal_uInt16 nNextMaster = pMasterPages->FindPage( pE->aSlideAtom.nMasterId );
+                                                auto nOrigMasterId = pE->aSlideAtom.nMasterId;
+                                                sal_uInt16 nNextMaster = pMasterPages->FindPage(nOrigMasterId);
                                                 if ( nNextMaster == PPTSLIDEPERSIST_ENTRY_NOTFOUND )
                                                     break;
                                                 else
                                                     pE = &(*pPageList)[ nNextMaster ];
+                                                if (pE->aSlideAtom.nMasterId == nOrigMasterId)
+                                                {
+                                                    SAL_WARN("filter.ms", "loop in atom chain");
+                                                    break;
+                                                }
                                             }
                                             if ( pE->nBackgroundOffset )
                                             {
diff --git a/sd/qa/unit/data/ppt/pass/hang-9.ppt b/sd/qa/unit/data/ppt/pass/hang-9.ppt
new file mode 100644
index 0000000..97e0158
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-9.ppt differ
diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx
index db2a05c..5fe2bdc 100644
--- a/sd/source/filter/ppt/pptin.cxx
+++ b/sd/source/filter/ppt/pptin.cxx
@@ -725,11 +725,17 @@ bool ImplSdPPTImport::Import()
                 PptSlidePersistEntry* pE = pPersist;
                 while( ( pE->aSlideAtom.nFlags & 4 ) && pE->aSlideAtom.nMasterId )
                 {
-                    sal_uInt16 nNextMaster = pMasterPages->FindPage( pE->aSlideAtom.nMasterId );
+                    auto nOrigMasterId = pE->aSlideAtom.nMasterId;
+                    sal_uInt16 nNextMaster = pMasterPages->FindPage(nOrigMasterId);
                     if ( nNextMaster == PPTSLIDEPERSIST_ENTRY_NOTFOUND )
                         break;
                     else
                         pE = &(*pList)[ nNextMaster ];
+                    if (pE->aSlideAtom.nMasterId == nOrigMasterId)
+                    {
+                        SAL_WARN("filter.ms", "loop in atom chain");
+                        break;
+                    }
                 }
                 SdrObject* pObj = ImportPageBackgroundObject( *pMPage, pE->nBackgroundOffset, true );   // import background
                 if ( pObj )