[Libreoffice-commits] core.git: sd/source

[Libreoffice Gerrit user]

 sd/source/filter/ppt/pptin.cxx |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

New commits:
commit 8ae5d297d46c79a73a02c856417804c371a711ac
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Jan 11 11:18:18 2019 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Fri Jan 11 15:55:46 2019 +0100

    ofz#11243 timeout with bogus length
    
    Change-Id: I707f31b704ed6e67183bdbd60ea1c1cc126dac09
    Reviewed-on: https://gerrit.libreoffice.org/66161
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx
index 066b8ef203e0..12887386c583 100644
--- a/sd/source/filter/ppt/pptin.cxx
+++ b/sd/source/filter/ppt/pptin.cxx
@@ -1297,7 +1297,15 @@ bool ImplSdPPTImport::Import()
                         if ( SeekToRec( rStCtrl, PPT_PST_NamedShowSlides, aCuHeader.GetRecEndFilePos(), &aContent ) )
                         {
                             PptSlidePersistList* pPageList = GetPageList( PPT_SLIDEPAGE );
-                            sal_uInt32 nSCount = aContent.nRecLen >> 2;
+                            const auto nRemainingSize = rStCtrl.remainingSize();
+                            sal_uInt32 nBCount = aContent.nRecLen;
+                            if (nBCount > nRemainingSize)
+                            {
+                                SAL_WARN("filter.ms", "page number data len longer than remaining stream size");
+                                nBCount = nRemainingSize;
+                            }
+                            sal_uInt32 nSCount = nBCount >> 2;
+
                             if ( pPageList && nSCount )
                             {
                                 SdCustomShowList* pList = mpDoc->GetCustomShowList( true );