From a46fade2c1c7ea29ff7553d5d10afbf813839af1 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Thu, 5 Sep 2013 12:57:59 +0100 Subject: CID#1078757 nOfs <= nPersistPtrAnz Change-Id: Icf2729a4a7f8476d71d4609e060d3da2d172e7a8 --- filter/source/msfilter/svdfppt.cxx | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'filter') diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx index 41307b7b6631..f8a0f42d35e0 100644 --- a/filter/source/msfilter/svdfppt.cxx +++ b/filter/source/msfilter/svdfppt.cxx @@ -1319,13 +1319,13 @@ SdrPowerPointImport::SdrPowerPointImport( PowerPointImportParam& rParam, const O bOk = sal_False; // (it should not be greater than the PPT_PST_PersistPtrIncrementalBlock, but // we are reading this block later, so we do not have access yet) - if ( bOk && ( nPersistPtrAnz < ( SAL_MAX_UINT32 / sizeof( sal_uInt32 ) ) ) ) - pPersistPtr = new (std::nothrow) sal_uInt32[ nPersistPtrAnz ]; + if ( bOk && ( nPersistPtrAnz < ( SAL_MAX_UINT32 / sizeof( sal_uInt32 ) ) -1 ) ) + pPersistPtr = new (std::nothrow) sal_uInt32[ nPersistPtrAnz + 1 ]; if ( !pPersistPtr ) bOk = sal_False; if ( bOk ) { - memset( pPersistPtr, 0x00, nPersistPtrAnz * 4 ); + memset( pPersistPtr, 0x00, (nPersistPtrAnz+1) * sizeof(sal_uInt32) ); // SJ: new search mechanism from bottom to top (Issue 21122) PptUserEditAtom aCurrentEditAtom( aUserEditAtom ); @@ -1343,14 +1343,14 @@ SdrPowerPointImport::SdrPowerPointImport( PowerPointImportParam& rParam, const O sal_uLong nPibLen = aPersistHd.GetRecEndFilePos(); while ( bOk && ( rStCtrl.GetError() == 0 ) && ( rStCtrl.Tell() < nPibLen ) ) { - sal_uInt32 nOfs, nAnz; + sal_uInt32 nOfs(0); rStCtrl >> nOfs; - nAnz = nOfs; + sal_uInt32 nAnz = nOfs; nOfs &= 0x000FFFFF; nAnz >>= 20; while ( bOk && ( rStCtrl.GetError() == 0 ) && ( nAnz > 0 ) && ( nOfs <= nPersistPtrAnz ) ) { - sal_uInt32 nPt; + sal_uInt32 nPt(0); rStCtrl >> nPt; if ( !pPersistPtr[ nOfs ] ) { -- cgit