[Libreoffice] [PATCH] Fix for fdo#39898: don't crash on some invalid MathML objects

[Ivan Timofeev]

This patch fixes crash while processing MathML objects that contain invalid
<mmultiscripts> elements.

MathML object "Object 1/content.xml" from "Formula-crash.odp" file (attached
to bug report https://bugs.freedesktop.org/show_bug.cgi?id=39898 ) contains
the following element:

<mmultiscripts>
  <mtext/>
   <mprescripts/>
  <none/>
</mmultiscripts>

This <mmultiscripts> element is invalid since it contains odd number of
elements after <mprescripts/> (see
http://www.w3.org/TR/MathML/chapter3.html#presm.mmultiscripts ) and
LibreOffice crashes on it.

I found inconsistency between SmXMLMultiScriptsContext_Impl::EndElement and
SmXMLMultiScriptsContext_Impl::MiddleElement (file
starmath/source/mathmlimport.cxx). MiddleElement used for processing
postscripts and EndElement used for processing prescripts. The contents of
these methods are almost identical, but in MiddleElement we can see:

if (pScriptNode->GetToken().aText.Len())

and in EndElement:

if (pScriptNode && ((pScriptNode->GetToken().eType != TIDENT) ||
(pScriptNode->GetToken().aText.Len())))

In method MiddleElement variable pScriptNode becomes NULL if number of
elements is odd. So, I merged content of methods MiddleElement and
EndElement into method ProcessSubSupPairs using second variant of the
condition.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/libreoffice/attachments/20110923/b60fbdeb/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Fix-for-fdo-39898-don-t-crash-on-some-invalid-MathML.patch
Type: text/x-patch
Size: 6385 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/libreoffice/attachments/20110923/b60fbdeb/attachment.bin>