[Libreoffice-commits] core.git: sd/source

[Caolán McNamara]

 sd/source/filter/ppt/propread.cxx |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

New commits:
commit 96976553c41e8e7af47ad3d25927f5018279f6c7
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Oct 21 16:59:19 2017 +0100

    check ppt property size against max available len
    
    Change-Id: Ie99a68ea34edfb480d41cf832d3044f4bf686585
    Reviewed-on: https://gerrit.libreoffice.org/43661
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx
index ed1f9e4923d2..6854a7dc1a44 100644
--- a/sd/source/filter/ppt/propread.cxx
+++ b/sd/source/filter/ppt/propread.cxx
@@ -326,7 +326,13 @@ void Section::Read( SotStorageStream *pStrm )
 
     mnTextEnc = RTL_TEXTENCODING_MS_1252;
     sal_uInt32 nSecSize(0), nPropCount(0);
-    pStrm->ReadUInt32( nSecSize ).ReadUInt32( nPropCount );
+    pStrm->ReadUInt32(nSecSize).ReadUInt32(nPropCount);
+    if (nSecSize > nStrmSize)
+    {
+        SAL_WARN("sd.filter", "Section Len " << nSecSize << " claimed, only " << nStrmSize << " possible");
+        nSecSize = nStrmSize;
+    }
+
     while (nPropCount--)
     {
         sal_uInt32 nPropId(0), nPropOfs(0);
@@ -514,7 +520,7 @@ void Section::Read( SotStorageStream *pStrm )
         }
         pStrm->Seek(nCurrent);
     }
-    pStrm->Seek( nSecOfs + nSecSize );
+    pStrm->Seek(nSecOfs + nSecSize);
 }
 
 Section& Section::operator=( const Section& rSection )