mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Related: #i124661# crash when loading and re-saving ppt file...

Browse Source 
with a single customshape

check the equation array element number. If the number is greater than 128, the
equation array will not be imported.

(cherry picked from commit 48653aa3a1cc24ed9ad8a14ae035b38a751e561d)

Conflicts:
	filter/source/msfilter/msdffimp.cxx

Change-Id: I49ac6ec5610a7761ca3ed4905d6fe1bc7ec079d0
This commit is contained in:
Steve Yin
2014-04-15 10:12:14 +00:00
committed by Caolán McNamara
parent d8c6707b11
commit b827f6f81f
2 changed files with 15 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
filter/source/msfilter/escherex.cxx
View File

@@ -2582,7 +2582,7 @@ void ConvertEnhancedCustomShapeEquation( SdrObjCustomShape* pCustoShape,
if ( pAny )
*pAny >>= sEquationSource;
sal_Int32 nEquationSourceCount = sEquationSource.getLength();
if ( nEquationSourceCount )
if ( nEquationSourceCount && (nEquationSourceCount <= 128) )
{
sal_Int32 i;
for ( i = 0; i < nEquationSourceCount; i++ )

8
filter/source/msfilter/msdffimp.cxx
View File

@@ -1866,12 +1866,13 @@ void DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
sal_uInt16 nElemSize = 8;
rIn.ReadUInt16( nNumElem ).ReadUInt16( nNumElemMem ).ReadUInt16( nElemSize );
}
sal_Int16 nP1, nP2, nP3;
sal_uInt16 nFlags;
if ( nNumElem <= 128 )
{
uno::Sequence< OUString > aEquations( nNumElem );
for ( sal_uInt16 i = 0; i < nNumElem; i++ )
{
sal_Int16 nP1(0), nP2(0), nP3(0);
sal_uInt16 nFlags(0);
rIn.ReadUInt16( nFlags ).ReadInt16( nP1 ).ReadInt16( nP2 ).ReadInt16( nP3 );
aEquations[ i ] = EnhancedCustomShape2d::GetEquation( nFlags, nP1, nP2, nP3 );
}
@@ -1881,6 +1882,7 @@ void DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
aProp.Value <<= aEquations;
aPropVec.push_back( aProp );
}
}
// "Handles" PropertySequence element