From dc1be62d75e654e17c2f4c02804b7fd48d5a2515 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
Date: Fri, 28 Aug 2015 16:14:07 +0100
Subject: [PATCH] check stream status

Change-Id: I609c8c4f4e843601361b61f55e0325ad99db3c23
---
 sd/qa/unit/data/ppt/pass/hang-20.ppt | Bin 0 -> 7732 bytes
 sd/source/filter/ppt/pptin.cxx       |  34 ++++++++++++++++++++-------
 2 files changed, 25 insertions(+), 9 deletions(-)
 create mode 100644 sd/qa/unit/data/ppt/pass/hang-20.ppt

diff --git a/sd/qa/unit/data/ppt/pass/hang-20.ppt b/sd/qa/unit/data/ppt/pass/hang-20.ppt
new file mode 100644
index 0000000000000000000000000000000000000000..7bfe75d7b1d9da3a08e28be7dfc0afc1ea3ce1fe
GIT binary patch
literal 7732
zcmeHLdvH|M8UOCR8?u<dU6LS(mRwU6)BwS4E3GXA2}mkP2BL!<TNaXCvg2kGb^}Od
zh6|`wkTw<ujqS+Gb|`&WYNr*n<R43F(~7oCb;e3M=oF<>7HkoD-Tr>(?oD=+O&cg<
zZO60o+w=a;cfQv-_Z)b6Sl70njQX?mN|VKq^Uh!yl+muCOsEtP(NSRiyyG}-qX>%q
zCmW;s@BO&vzaW8gSaV2Phd$(a0Ck=Z_<_N|Wk3N?2vFC=$Laq=0&}GazZS7%y2Ozu
zWCgT5@N_vW#*+kNL14q``fts7dDuhm$}V~C`XiZ?>~9`gFNyt{fkwO7?Ww`)%O#9;
zS&AwiEU7}dPL@g|ddOA(X{_iP;}B_*kN!ty_jC+(>v=Lyt<xwA)!wVIUIeQru=YZ%
z97Q>vJvFPw_31aB45T!xJ7?wdXg!q<q<MYzdSU!b!usCY1KocW)_)_tJ~K~#1Mz>x
z3X0AIa0JLOpa`HkOMv0P<-iDFBya^V3b+!u3it#t8ladg;A)@@_#|)*a4m2hFa{V4
zTo2p;+z6Bd<ACwN1fT+#2;2k&flmRS20jDa3`_z(3w#c^1z_Cz0`keg6rd8A3fu}z
z1K2+u`3&GTU?xxvd=a=EVE^oNPFa5h(tH0Y52hS33ZZyS-Z3a|9_ZAiA31d!Ku(>H
zM9%n+j7c-)gi(UZ1nDr@ULmiVv>*1Haxi}ua*>~#RrsF@Z;Ha3Vkmd8`Gum2j<s$8
z;Jnc0Vj;RtJT6DjzG!bz1#>3S5+UWMO+Wr^r8WBbchtIQ^3xu8UWt6q<XOeCE`u?t
zQg)d1Uc{(#)OeXCQjc6PU*#-IrOtoOa-3r<B2liiYqcR9ik4=%TSvK4cW3ah3>hJY
z9(8cqJ{xP2=K|kWl}qXgHprk<CI0<z2(ChTaUco0yt-#Ds;ZrRJcB`Aoxv<~?`x$X
zMVnvEh~r<&>HdeN;$QY@0eEA(h9>`us>RX#n4{^~n!i#;AE&Q!7Duq{eW<onQYL*;
z<UNDF%XKr7&9W&6^0#ABsg(HKvBP~FyJzDwC*`FlZ~0;Vrv1#hv?-^J#hfJP4J8z`
z$vJ~=c`s0(k)tSf*-?=PTy?X~v=U<fE}+2(o8^qbZ8J5a;MGaBvVbfV`xr{SHAp`b
z<)Hn$Xi)`C>v@<~pQIIoM!zi2Pm}X<E_-%tnq^G|A4ReAwBxMF!7^FQWSLti6-P-L
z8t~ByyhH;WdivqwNytrES4=HK#wNA4K>ccPKGq`Iv1ffT+u@f!il_N!E=*{Xk<Qa5
zt%n*V-|im^Ta=fwB(h6+3;Wd=<nJoAnR3dAW4bQK44ACy)%5(qo-)vc1i?xw-$DtS
zXM@=GDplCqby$MIHj%bAY3qcK^cuH$^JX>v%%O-lZ4v1VVrZoAINP?>xVBD5I)PxY
zQ+~YI>8AJQ$>XZuqenhA{0b~Yu;|WAdatW-%a<=#x#PSq!Ol)`YHF~4&p2$r-OHEe
zBS%O5B57>e&kX`S<7`mjTKANS9C~%5;{TT`LTb+Mw_nlCA9kh2Nf3L)_#pXuhU_`w
z{6)(c=h6#C+T`$2><O})vF>&?F7<ZLx()Y!S<&M@UU}s=(%QO4?5B2$(;1O>-gvH?
zUIcW=-{i^ns62G{{St{d&;{1TzC3-*oqV0@A7>4hL+u;n(fga_8w(~#=d&V@KD8CQ
z++p&p)cQnEEl2cp&SXc=a?BKiw}c($N)+7~to4e)j3uuDZbW4?%%)<Yg$8KD9*eC%
zXco#kZW64QSqD@k)^XEt`%@|!>$r)qzE=WyHeEohe{l|k)P01b`s1OHopce<v=j$!
zx$@tf12tH6t~*pTen=@IZtm4B(#4Lvy32#nT@OKm^kc8z-A@RV$(5SS0Z7egqqe|g
zI#EvE2+D|2hKce~WL3Ec)ZL`xCTHiMGBSfoNd}do3@U*PDgnf>Lf=*pHAPn^U_ksS
zMh|i`2+Nsb;3U(L`%+_7`{0xt(@@Dsx?HB_kvR9o@iUP>JIHNUS8oWS=VU}DPDYIN
zZ`8iNWxZ_D-h80}=VKA}hEoM+qR*fzrWkTegKhSXU^e<-IlUs7DHj@>kB;Yl&n?-n
zwf=QMgN0bm)3XZSGZEZ`mf|kNZ!Xr8xEn3THwNOjVSz(Uj(f+R%_y5K%T;jf9$Dri
zJiD@VWiudIVos(ki_$XI80!0#C8fAYNi>%%HE{i5$g*PB4XaK0waHs)wp>IiGi)pm
z#*|YojO4viw~b*=PPx!9d&|Y=+1N)zF7m{(m8Sg7*bNu=PVIbbl{fcvvYF?n?Wqjo
z=$oUETWPtWD0whi%5Arj?*M%hb3D0y74tlMA}u~01+{`y0>xGM7W5&$%)INUtd;{?
z{IW(u+Y8~llj?8}#0ZfGRdo3ptO<8oKu_Ow*Jw}P4KHW2e;@w6yKd$!cZ%BkKK%P-
zpP^%Jv6LO>-I+5&$OCRHk=gnmjkoayGc0AJmA-wS${#6iM$UWJP57_H_h0piJMiT<
z4R0f}@SBI0sknz_oRsij_D#p=>ELRQ$#0PsjI742gv^Iu*TUl`$({HrZNS^gL?Dj;
zq|8Aam=1cT3`yO}Wz%;vggT_1=1}}sTMHYlXna{T8C?_$i)=ILr2O_qf_$}fne$6f
zcB7-G0ek}VwcG(l#}CV+868CuBe*XOvSnI_0KFTQQvy-Egj=-8KiuyW=<ye&?xFJl
z#6xqS<!SOFp8+l^orjm?sTU+pSBJEsL)u*rZaMM6oQA;nAM?wNV}AO21=>2$L6+Db
z0$^^?t9#R?6;b4^04ePRiU3@v)Enw+$a!kN1<*570Cjm5;J3C9L`m;0?3-^Sq%|)V
ztq)rhRXu=uZBxRU6^+G~z$RKy=eYjbX-TwXj^XJuJ6e}$N;XAWtT~ZLv@UGbG%XJ&
zYMP?)7O6yk=;m4uSLODr%toGGY`3reQ}?@_f%<L0^8k(_hjqU^5?G9lY23AO7g`MU
zM&wGxfEiLt1>Bk{73wQwn^NOw_5FJmJs^c%ay$-F;LcC$oaOeo?V6%`jp4mG-X~jy
zARjmt)g1gCAtjHN?$X2)6lsjXTNyd-N!j}EX{UbmgTFoa?eSLzHa-shmw)i13bg$I
z9h5iw9|lOR6`&q>0$imXVBF~dc%wZ4kUQ$1cF_g!o#F^E0!RV0sZ#)HlQ>^L`g?<^
zMn8q=*$L;&iH}RxCBosjHLsxwpE;gg+|jfw9E+7()$uxpCdDt`KFK%tkePe^z4JY#
z1&TkmD|gJ1j|LN<)$4q%3P%<$jkQ=+;be4iJj<X9F@ZuNqa-@xEAf`3b!ReM@9|`N
zdvIr4wc*C**us{u*RQ71k6a(Ajkd(X$?i_H4=kNDuf@O;U_tw1ho6RQhREO5`$d+o
zQGvDUVc0^zkKzIslO?hYr6dCW|3K2HY9hmZbF)1S_tOM^?%TVCvnz>mBKP1Nt)pO_
wu1~uEIfnFUnuQiJcB#^Zu79c4_2^v0`V1X(N%xP1%*PtmFI~C__IeioCuHmlAOHXW

literal 0
HcmV?d00001

diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx
index 530be9c158d1..76f331d191dd 100644
--- a/sd/source/filter/ppt/pptin.cxx
+++ b/sd/source/filter/ppt/pptin.cxx
@@ -280,7 +280,6 @@ bool ImplSdPPTImport::Import()
                     if ( nSlideCount && pSection->GetProperty( PID_HEADINGPAIR, aPropItem ) )
                     {
                         sal_uInt32  nSlideTitleIndex = 0, nSlideTitleCount = 0;
-                        sal_uInt32  i, nTemp;
 
                         OUString aUString;
 
@@ -291,13 +290,14 @@ bool ImplSdPPTImport::Import()
                         {
                             nVecCount >>= 1;
                             sal_uInt32 nEntryCount = 0;
-                            for ( i = 0; i < nVecCount; i++ )
+                            for (sal_uInt32 i = 0; i < nVecCount; ++i)
                             {
                                 if ( !aPropItem.Read( aUString, VT_EMPTY, false ) )
                                     break;
                                 aPropItem.ReadUInt32( nType );
                                 if ( ( nType != VT_I4 ) && ( nType != VT_UI4 ) )
                                     break;
+                                sal_uInt32 nTemp(0);
                                 aPropItem.ReadUInt32( nTemp );
                                 if ( aUString == "Slide Titles" || aUString == "Folientitel" )
                                 {
@@ -312,17 +312,33 @@ bool ImplSdPPTImport::Import()
                             aPropItem.ReadUInt32( nType )
                                      .ReadUInt32( nVecCount );
 
-                            if ( ( nVecCount >= ( nSlideTitleIndex + nSlideTitleCount ) )
-                                    && ( nType == ( VT_LPSTR | VT_VECTOR ) ) )
+                            bool bVecOk = ( ( nVecCount >= (nSlideTitleIndex + nSlideTitleCount) )
+                                    && ( nType == ( VT_LPSTR | VT_VECTOR ) ) );
+
+                            if (bVecOk)
                             {
-                                for ( i = 0; i != nSlideTitleIndex; i++ )
+                                for (sal_uInt32 i = 0; i != nSlideTitleIndex; ++i)
                                 {
-                                    aPropItem.ReadUInt32( nTemp );
-                                    aPropItem.SeekRel( nTemp );
+                                    sal_uInt32 nTemp(0);
+                                    aPropItem.ReadUInt32(nTemp);
+                                    if (!aPropItem.good())
+                                    {
+                                        bVecOk = false;
+                                        break;
+                                    }
+                                    auto nPos = aPropItem.Tell() + nTemp;
+                                    if (nPos != aPropItem.Seek(nPos))
+                                    {
+                                        bVecOk = false;
+                                        break;
+                                    }
                                 }
-                                for ( i = 0; i < nSlideTitleCount; i++ )
+                            }
+                            if (bVecOk)
+                            {
+                                for (sal_uInt32 i = 0; i < nSlideTitleCount; ++i)
                                 {
-                                    if ( !aPropItem.Read( aUString, nType, false ) )
+                                    if (!aPropItem.Read(aUString, nType, false))
                                         break;
 
                                     OUString aString( aUString );