[Libreoffice-commits] core.git: sd/qa sfx2/source

[Caolán McNamara (via logerrit)]

 sfx2/source/doc/oleprops.cxx |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

New commits:
commit 96ea80a725dfe4ef38993f78917c243f13e3beb5
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Dec 31 16:29:06 2020 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Fri Jan 1 20:41:04 2021 +0100

    ofz#29129 Abrt on uncaught exception
    
    Change-Id: I249e1f6e2fcc94e5de22d1f7c7d8a0e7cc185ace
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/108540
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sd/qa/unit/data/ppt/fail/crash-1.ppt b/sd/qa/unit/data/ppt/pass/crash-1.ppt
similarity index 100%
rename from sd/qa/unit/data/ppt/fail/crash-1.ppt
rename to sd/qa/unit/data/ppt/pass/crash-1.ppt
diff --git a/sd/qa/unit/data/ppt/fail/hang-4.ppt b/sd/qa/unit/data/ppt/pass/hang-4.ppt
similarity index 100%
rename from sd/qa/unit/data/ppt/fail/hang-4.ppt
rename to sd/qa/unit/data/ppt/pass/hang-4.ppt
diff --git a/sd/qa/unit/data/ppt/fail/hang-6.ppt b/sd/qa/unit/data/ppt/pass/hang-6.ppt
similarity index 100%
rename from sd/qa/unit/data/ppt/fail/hang-6.ppt
rename to sd/qa/unit/data/ppt/pass/hang-6.ppt
diff --git a/sfx2/source/doc/oleprops.cxx b/sfx2/source/doc/oleprops.cxx
index 796ce0d5227a..621a82f6d9a5 100644
--- a/sfx2/source/doc/oleprops.cxx
+++ b/sfx2/source/doc/oleprops.cxx
@@ -941,12 +941,13 @@ void SfxOleSection::ImplLoad( SvStream& rStrm )
     mnStartPos = rStrm.Tell();
     sal_uInt32 nSize(0);
     sal_Int32 nPropCount(0);
-    rStrm.ReadUInt32( nSize ).ReadInt32( nPropCount );
+    if (rStrm.remainingSize() >= 8)
+        rStrm.ReadUInt32( nSize ).ReadInt32( nPropCount );
 
     // read property ID/position pairs
     typedef ::std::map< sal_Int32, sal_uInt32 > SfxOlePropPosMap;
     SfxOlePropPosMap aPropPosMap;
-    for (sal_Int32 nPropIdx = 0; nPropIdx < nPropCount && rStrm.good(); ++nPropIdx)
+    for (sal_Int32 nPropIdx = 0; nPropIdx < nPropCount && rStrm.good() && rStrm.remainingSize() >= 8; ++nPropIdx)
     {
         sal_Int32 nPropId(0);
         sal_uInt32 nPropPos(0);
@@ -956,7 +957,7 @@ void SfxOleSection::ImplLoad( SvStream& rStrm )
 
     // read codepage property
     SfxOlePropPosMap::iterator aCodePageIt = aPropPosMap.find( PROPID_CODEPAGE );
-    if( (aCodePageIt != aPropPosMap.end()) && SeekToPropertyPos( rStrm, aCodePageIt->second ) )
+    if( (aCodePageIt != aPropPosMap.end()) && SeekToPropertyPos(rStrm, aCodePageIt->second) && rStrm.remainingSize() >= 4)
     {
         // codepage property must be of type signed int-16
         sal_Int32 nPropType(0);
@@ -972,7 +973,7 @@ void SfxOleSection::ImplLoad( SvStream& rStrm )
     if( (aDictIt != aPropPosMap.end()) && SeekToPropertyPos( rStrm, aDictIt->second ) )
     {
         // #i66214# #i66428# applications may write broken dictionary properties in wrong sections
-        if( mbSupportsDict )
+        if (mbSupportsDict && rStrm.remainingSize() >= 4)
         {
             // dictionary property contains number of pairs in property type field
             sal_Int32 nNameCount(0);