[Libreoffice-commits] core.git: Branch 'libreoffice-7-2' - starmath/source

[Caolán McNamara (via logerrit)]

 starmath/source/mathtype.cxx |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

New commits:
commit e9a68832ada43d051ee90f453b82634543057077
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Aug 24 20:42:53 2021 +0100
Commit:     Xisco Fauli <xiscofauli at libreoffice.org>
CommitDate: Wed Aug 25 10:03:50 2021 +0200

    ofz: MemorySanitizer: use-of-uninitialized-value
    
    Change-Id: I15d68391e20fba3a8ba46621aac0c831cd0900b0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/120890
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofauli at libreoffice.org>

diff --git a/starmath/source/mathtype.cxx b/starmath/source/mathtype.cxx
index cb46776cc618..acdeba5fcfb6 100644
--- a/starmath/source/mathtype.cxx
+++ b/starmath/source/mathtype.cxx
@@ -570,7 +570,7 @@ bool MathType::Parse(SvStream* pStream)
     pS->ReadUChar( nProdVersion );
     pS->ReadUChar( nProdSubVersion );
 
-    if (nVersion > 3)   // allow only supported versions of MathType to be parsed
+    if (!pS->good() || nVersion > 3)   // allow only supported versions of MathType to be parsed
         return false;
 
     bool bRet = HandleRecords(0);
@@ -637,7 +637,7 @@ bool MathType::HandleRecords(int nLevel, sal_uInt8 nSelector,
         return false;
 
     sal_uInt8 nTag,nRecord;
-    sal_uInt8 nTabType,nTabStops;
+    sal_uInt8 nTabType;
     sal_uInt16 nTabOffset;
     int i, newline=0;
     bool bSilent=false;
@@ -1688,6 +1688,8 @@ bool MathType::HandleRecords(int nLevel, sal_uInt8 nSelector,
                 HandleEmblishments();
                 break;
             case RULER:
+            {
+                sal_uInt8 nTabStops(0);
                 pS->ReadUChar( nTabStops );
                 for (i=0;i<nTabStops;i++)
                 {
@@ -1696,6 +1698,7 @@ bool MathType::HandleRecords(int nLevel, sal_uInt8 nSelector,
                 }
                 SAL_WARN("starmath", "Not seen in the wild Equation Ruler Field");
                 break;
+            }
             case FONT:
                 {
                     MathTypeFont aFont;