mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ofz#3811 Integer-overflow

Browse Source 
Change-Id: Ia08ac1ae46d4af6df7b0a590752e17a6d9a6836e
Reviewed-on: https://gerrit.libreoffice.org/43869
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
This commit is contained in:
Caolán McNamara
2017-10-26 09:13:03 +01:00
parent 8f3ca2e63b
commit 3fc4211a0f
1 changed files with 22 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
filter/source/msfilter/svdfppt.cxx
View File

@@ -6703,23 +6703,24 @@ PPTTextObj::PPTTextObj( SvStream& rIn, SdrPowerPointImport& rSdrPowerPointImport
sal_uInt32 nCharIdx = pSpecInfo->nCharIdx;
// portions and text have to been splitted in some cases
for ( ; nI < aStyleTextPropReader.aCharPropList.size(); )
for ( ; nI < aStyleTextPropReader.aCharPropList.size(); ++nI)
{
PPTCharPropSet* pSet = aStyleTextPropReader.aCharPropList[nI];
if ( pSet->mnOriginalTextPos < nCharIdx )
{
if (pSet->mnOriginalTextPos >= nCharIdx)
break;
pSet->mnLanguage[0] = pSpecInfo->nLanguage[0];
pSet->mnLanguage[1] = pSpecInfo->nLanguage[1];
pSet->mnLanguage[2] = pSpecInfo->nLanguage[2];
// test if the current portion needs to be splitted
if ( pSet->maString.getLength() > 1 )
{
if (pSet->maString.getLength() <= 1)
continue;
sal_Int32 nIndexOfNextPortion = pSet->maString.getLength() + pSet->mnOriginalTextPos;
sal_Int32 nNewLen = nIndexOfNextPortion - nCharIdx;
if (nNewLen <= 0)
continue;
sal_Int32 nOldLen = pSet->maString.getLength() - nNewLen;
if ( ( nNewLen > 0 ) && ( nOldLen > 0 ) )
{
if (nOldLen <= 0)
continue;
OUString aString(pSet->maString);
PPTCharPropSet* pNew = new PPTCharPropSet(*pSet);
pSet->maString = aString.copy(0, nOldLen);
@@ -6729,12 +6730,6 @@ PPTTextObj::PPTTextObj( SvStream& rIn, SdrPowerPointImport& rSdrPowerPointImport
}
}
}
else
break;
nI++;
}
}
}
#ifdef DBG_UTIL
else
{