[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - sd/qa sd/source

[Caolán McNamara]

 sd/qa/unit/data/ppt/pass/crash-2.ppt |binary
 sd/source/filter/ppt/propread.cxx    |   11 +++++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

New commits:
commit 4b9ff37a4b4bf2e97ff80146a8c4f42b2f55955b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Aug 28 14:33:05 2015 +0100

    guard against 0 item size
    
    Change-Id: I9c4c2f0fe2d892615b3c70e08da0cab6da13338a
    (cherry picked from commit 2aadad1e89e96cb80c15fe1069cb6365f0cade1d)
    Reviewed-on: https://gerrit.libreoffice.org/18117
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/sd/qa/unit/data/ppt/pass/crash-2.ppt b/sd/qa/unit/data/ppt/pass/crash-2.ppt
new file mode 100644
index 0000000..78a4da4
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/crash-2.ppt differ
diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx
index 54807ef..1dbb832 100644
--- a/sd/source/filter/ppt/propread.cxx
+++ b/sd/source/filter/ppt/propread.cxx
@@ -93,7 +93,7 @@ bool PropItem::Read( OUString& rString, sal_uInt32 nStringType, bool bAlign )
     {
         case VT_LPSTR :
         {
-            if ( nItemSize )
+            if (nItemSize)
             {
                 auto nMaxSizePossible = remainingSize();
                 if (nItemSize > nMaxSizePossible)
@@ -101,6 +101,10 @@ bool PropItem::Read( OUString& rString, sal_uInt32 nStringType, bool bAlign )
                     SAL_WARN("sd.filter", "String of Len " << nItemSize << " claimed, only " << nMaxSizePossible << " possible");
                     nItemSize = nMaxSizePossible;
                 }
+            }
+
+            if (nItemSize)
+            {
                 try
                 {
                     sal_Char* pString = new sal_Char[ nItemSize ];
@@ -144,7 +148,7 @@ bool PropItem::Read( OUString& rString, sal_uInt32 nStringType, bool bAlign )
 
         case VT_LPWSTR :
         {
-            if ( nItemSize )
+            if (nItemSize)
             {
                 auto nMaxSizePossible = remainingSize() / sizeof(sal_Unicode);
                 if (nItemSize > nMaxSizePossible)
@@ -152,7 +156,10 @@ bool PropItem::Read( OUString& rString, sal_uInt32 nStringType, bool bAlign )
                     SAL_WARN("sd.filter", "String of Len " << nItemSize << " claimed, only " << nMaxSizePossible << " possible");
                     nItemSize = nMaxSizePossible;
                 }
+            }
 
+            if (nItemSize)
+            {
                 try
                 {
                     sal_Unicode* pString = new sal_Unicode[ nItemSize ];