[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/idxf/dxfentrd.cxx |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

New commits:
commit 50a3e578e82a11c3106927b0f59e7d6e19770cc0
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Jan 17 21:35:40 2017 +0000

    ofz: fix other similar pattern
    
    Change-Id: Ida04023df12186ef299c7f82e85778af7edb7d0a

diff --git a/filter/source/graphicfilter/idxf/dxfentrd.cxx b/filter/source/graphicfilter/idxf/dxfentrd.cxx
index a3e64f1..a91ecb2 100644
--- a/filter/source/graphicfilter/idxf/dxfentrd.cxx
+++ b/filter/source/graphicfilter/idxf/dxfentrd.cxx
@@ -424,6 +424,8 @@ void DXFLWPolyLineEntity::EvaluateGroup( DXFGroupReader & rDGR )
             // limit alloc to max reasonable size based on remaining data in stream
             if (nCount > 0 && static_cast<sal_uInt32>(nCount) <= rDGR.remainingSize())
                 pP.reset( new DXFVector[ nCount ] );
+            else
+                nCount = 0;
         }
         break;
         case 70: nFlags = rDGR.GetI(); break;
@@ -581,8 +583,11 @@ bool DXFBoundaryPathData::EvaluateGroup( DXFGroupReader & rDGR )
             case 93 :
             {
                 nPointCount = rDGR.GetI();
-                if ( nPointCount )
+                // limit alloc to max reasonable size based on remaining data in stream
+                if (nPointCount > 0 && static_cast<sal_uInt32>(nPointCount) <= rDGR.remainingSize())
                     pP.reset( new DXFVector[ nPointCount ] );
+                else
+                    nPointCount = 0;
             }
             break;
             case 72 : nHasBulgeFlag = rDGR.GetI(); break;