[Libreoffice-commits] core.git: 2 commits - basegfx/source filter/source

[Caolán McNamara]

 basegfx/source/tools/stringconversiontools.cxx |    2 -
 filter/source/svg/svgreader.cxx                |   45 +++++++++++++------------
 2 files changed, 25 insertions(+), 22 deletions(-)

New commits:
commit cb7d12ea4d67278edaf0240a67221ca5d5d8e93c
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Feb 9 10:05:07 2016 +0000

    crashtesting: crash on loading moz414782-1.svg
    
    Change-Id: I1324b902c0790350bc8c44e7d63ce45915e3b33f

diff --git a/basegfx/source/tools/stringconversiontools.cxx b/basegfx/source/tools/stringconversiontools.cxx
index f8181a6..8ea8624 100644
--- a/basegfx/source/tools/stringconversiontools.cxx
+++ b/basegfx/source/tools/stringconversiontools.cxx
@@ -50,7 +50,7 @@ namespace basegfx
                            sal_Int32&      io_rPos,
                            const OUString& rStr)
         {
-            sal_Unicode aChar( rStr[io_rPos] );
+            sal_Unicode aChar = io_rPos < rStr.getLength() ? rStr[io_rPos] : 0;
             OUStringBuffer sNumberString;
 
             // sign
commit 3d42c1fc15c4c2dacf5da7d6555e3fc7ac10416c
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Feb 9 09:56:43 2016 +0000

    crashtesting: crash on loading moz330387-6.svg
    
    Change-Id: I9bba4cd9332320285c06ca3ba8eaf94ab89dfeef

diff --git a/filter/source/svg/svgreader.cxx b/filter/source/svg/svgreader.cxx
index f3aeb17..243aa2c 100644
--- a/filter/source/svg/svgreader.cxx
+++ b/filter/source/svg/svgreader.cxx
@@ -348,29 +348,32 @@ struct AnnotatingVisitor
             }
             case XML_STOP:
             {
-                const sal_Int32 nNumAttrs( xAttributes->getLength() );
-                maGradientStopVector.push_back(GradientStop());
-                maGradientVector.back().maStops.push_back(maGradientStopVector.size()-1);
-
-                // first parse 'color' as 'stop-color' might depend on it
-                // if 'stop-color''s value is "currentColor" and parsed previously
-                uno::Reference<xml::dom::XNode> xNodeColor(xAttributes->getNamedItem("color"));
-                if(xNodeColor.is())
-                    parseGradientStop( maGradientStopVector.back(),
-                        maGradientStopVector.size()-1,
-                        XML_STOP_COLOR,
-                        xNodeColor->getNodeValue() );
-
-                //now, parse the rest of attributes
-                for( sal_Int32 i=0; i<nNumAttrs; ++i )
+                if (!maGradientVector.empty())
                 {
-                    const sal_Int32 nTokenId(
-                        getTokenId(xAttributes->item(i)->getNodeName()));
-                    if ( nTokenId != XML_COLOR )
+                    const sal_Int32 nNumAttrs( xAttributes->getLength() );
+                    maGradientStopVector.push_back(GradientStop());
+                    maGradientVector.back().maStops.push_back(maGradientStopVector.size()-1);
+
+                    // first parse 'color' as 'stop-color' might depend on it
+                    // if 'stop-color''s value is "currentColor" and parsed previously
+                    uno::Reference<xml::dom::XNode> xNodeColor(xAttributes->getNamedItem("color"));
+                    if(xNodeColor.is())
                         parseGradientStop( maGradientStopVector.back(),
-                                           maGradientStopVector.size()-1,
-                                           nTokenId,
-                                           xAttributes->item(i)->getNodeValue() );
+                            maGradientStopVector.size()-1,
+                            XML_STOP_COLOR,
+                            xNodeColor->getNodeValue() );
+
+                    //now, parse the rest of attributes
+                    for( sal_Int32 i=0; i<nNumAttrs; ++i )
+                    {
+                        const sal_Int32 nTokenId(
+                            getTokenId(xAttributes->item(i)->getNodeName()));
+                        if ( nTokenId != XML_COLOR )
+                            parseGradientStop( maGradientStopVector.back(),
+                                               maGradientStopVector.size()-1,
+                                               nTokenId,
+                                               xAttributes->item(i)->getNodeValue() );
+                    }
                 }
                 break;
             }