diff options
| author | Mark Wielaard <mark@klomp.org> | 2013-07-07 22:22:25 +0200 |
|---|---|---|
| committer | Michael Stahl <mstahl@redhat.com> | 2013-07-08 11:50:59 +0000 |
| commit | fb1931f94724703243c31e6be72267c327052f56 (patch) | |
| tree | 07c91c747e08a3b6f36d5b7edf65caf47a1faf24 /starmath | |
| parent | bnc#822175 DOCX filter: export wrapping of text frames (diff) | |
| download | core-fb1931f94724703243c31e6be72267c327052f56.tar.gz core-fb1931f94724703243c31e6be72267c327052f56.zip | |
Robustify MathType::HandleRecords.
Initialize nTag to zero before reading from the stream. In case the
stream is faulty. That will make nRecord equal to END so we drop out
of the do while loop and don't use unitialized variables.
Change-Id: Iad135e8d7f53c41cf8a764e5c7ab0f0cc5ffc6f0
Reviewed-on: https://gerrit.libreoffice.org/4759
Reviewed-by: Michael Stahl <mstahl@redhat.com>
Tested-by: Michael Stahl <mstahl@redhat.com>
Diffstat (limited to 'starmath')
| -rw-r--r-- | starmath/source/mathtype.cxx | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/starmath/source/mathtype.cxx b/starmath/source/mathtype.cxx index b910a41daa10..22b48f725495 100644 --- a/starmath/source/mathtype.cxx +++ b/starmath/source/mathtype.cxx @@ -670,6 +670,7 @@ int MathType::HandleRecords(int nLevel,sal_uInt8 nSelector, do { + nTag = 0; *pS >> nTag; nRecord = nTag&0x0F; |