[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - sd/qa sd/source

[Caolán McNamara]

 sd/qa/unit/data/ppt/pass/hang-21.ppt |binary
 sd/source/filter/ppt/propread.cxx    |    8 ++++++++
 2 files changed, 8 insertions(+)

New commits:
commit 2ab9d3eac916468c303f8bf9b919805418f813c1
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Aug 29 20:26:27 2015 +0100

    check stream status
    
    Change-Id: I6b9537cf94ac1c5d996ba64ddf878745dadde254
    (cherry picked from commit 452cd9e75de657e996e17510fe5d3539065489d1)
    Reviewed-on: https://gerrit.libreoffice.org/18128
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/sd/qa/unit/data/ppt/pass/hang-21.ppt b/sd/qa/unit/data/ppt/pass/hang-21.ppt
new file mode 100644
index 0000000..99cf49f
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-21.ppt differ
diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx
index be288c8..ca9cbe0 100644
--- a/sd/source/filter/ppt/propread.cxx
+++ b/sd/source/filter/ppt/propread.cxx
@@ -497,10 +497,18 @@ void Section::Read( SotStorageStream *pStrm )
         {
             sal_uInt32 nDictCount(0);
             pStrm->ReadUInt32(nDictCount);
+            auto nMaxRecordsPossible = pStrm->remainingSize() / (sizeof(sal_uInt32)*2);
+            if (nDictCount > nMaxRecordsPossible)
+            {
+                SAL_WARN("sd.filter", "Dictionary count of " << nDictCount << " claimed, only " << nMaxRecordsPossible << " possible");
+                nDictCount = nMaxRecordsPossible;
+            }
             for (sal_uInt32 i = 0; i < nDictCount; ++i)
             {
                 sal_uInt32 nSize(0);
                 pStrm->ReadUInt32( nSize ).ReadUInt32( nSize );
+                if (!pStrm->good())
+                    break;
                 sal_uInt64 nPos = pStrm->Tell() + nSize;
                 if (nPos != pStrm->Seek(nPos))
                     break;