[Libreoffice-commits] core.git: sd/source

[Caolán McNamara]

 sd/source/filter/ppt/pptin.cxx |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

New commits:
commit 069e727e1049eaaeb1cbbd7fdd14d8d47abc1f8b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jan 12 20:44:25 2018 +0000

    ofz#5274 Out-of-memory
    
    Change-Id: I3e69f5e2be848933a43d09c620dafd946486e731

diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx
index 0b64546358d7..ef16cadef0d6 100644
--- a/sd/source/filter/ppt/pptin.cxx
+++ b/sd/source/filter/ppt/pptin.cxx
@@ -1953,15 +1953,21 @@ OUString ImplSdPPTImport::ReadSound(sal_uInt32 nSoundRef) const
                             INetURLObject aGalleryUserSound( aGalleryDir.getToken( nTokenCount - 1, ';' ) );
 
                             aGalleryUserSound.Append( aRetval );
+                            const auto nRemainingSize = rStCtrl.remainingSize();
                             sal_uInt32 nSoundDataLen = aSoundDataRecHd.nRecLen;
-                            std::unique_ptr<sal_uInt8[]> pBuf( new sal_uInt8[ nSoundDataLen ] );
+                            if (nSoundDataLen > nRemainingSize)
+                            {
+                                SAL_WARN("filter.ms", "sound data len longer than remaining stream size");
+                                nSoundDataLen = nRemainingSize;
+                            }
+                            std::vector<sal_uInt8> aBuf(nSoundDataLen);
 
-                            rStCtrl.ReadBytes(pBuf.get(), nSoundDataLen);
+                            rStCtrl.ReadBytes(aBuf.data(), nSoundDataLen);
                             SvStream* pOStm = ::utl::UcbStreamHelper::CreateStream( aGalleryUserSound.GetMainURL( INetURLObject::DecodeMechanism::NONE ), StreamMode::WRITE | StreamMode::TRUNC );
 
                             if( pOStm )
                             {
-                                pOStm->WriteBytes(pBuf.get(), nSoundDataLen);
+                                pOStm->WriteBytes(aBuf.data(), nSoundDataLen);
 
                                 if( pOStm->GetError() == ERRCODE_NONE )
                                 {