[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/msfilter/svdfppt.cxx |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

New commits:
commit 76db55774571af5139bce79f595903a2657b7f46
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Jan 9 16:31:05 2018 +0000

    ofz#5154 limit depth to max legal depth
    
    Change-Id: Ic1b0daf874b9df13ad012d11efaee1c31a47b1d6
    Reviewed-on: https://gerrit.libreoffice.org/47666
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index 5f0b33973bb9..32674f5ccf5e 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -3321,7 +3321,8 @@ PPTExtParaProv::PPTExtParaProv( SdrPowerPointImport& rMan, SvStream& rSt, const
                     if ( aHd.nRecInstance < PPT_STYLESHEETENTRYS )
                     {
                         sal_uInt16 nDepth = 0, i = 0;
-                        rSt.ReadUInt16( nDepth );
+                        rSt.ReadUInt16(nDepth);
+                        nDepth = std::min<sal_uInt16>(nDepth, nMaxPPTLevels);
                         auto nHdEndRecPos = DffPropSet::SanitizeEndPos(rSt, aHd.GetRecEndFilePos());
                         while ( ( rSt.GetError() == ERRCODE_NONE ) && ( rSt.Tell() < nHdEndRecPos ) && ( i < nDepth ) )
                         {
@@ -3409,8 +3410,9 @@ bool PPTNumberFormatCreator::ImplGetExtNumberFormat( SdrPowerPointImport const &
     }
 
     if ( ( nBuFlags & 0x03800000 ) != 0x03800000 )  // merge style sheet
-    {   // we have to read the master attributes
-        if ( pParaProv && ( nLevel < 5 ) )
+    {
+        // we have to read the master attributes
+        if (pParaProv && nLevel < nMaxPPTLevels)
         {
             if ( pParaProv->bStyles )
             {