From 7109a4dea588e989b384b0de081fdf6a80e68404 Mon Sep 17 00:00:00 2001 From: konovalovsergey <Sergey.Konovalov@onlyoffice.com> Date: Fri, 14 Oct 2016 12:52:15 +0300 Subject: [PATCH] crash: vml path with formula reference to nonexistent formula. --- .../Editor/Drawing/Shapes/BaseShape/Path.h | 26 +++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/ASCOfficePPTXFile/Editor/Drawing/Shapes/BaseShape/Path.h b/ASCOfficePPTXFile/Editor/Drawing/Shapes/BaseShape/Path.h index 3f6b918f4..9b014b4f6 100644 --- a/ASCOfficePPTXFile/Editor/Drawing/Shapes/BaseShape/Path.h +++ b/ASCOfficePPTXFile/Editor/Drawing/Shapes/BaseShape/Path.h @@ -1354,8 +1354,30 @@ namespace NSPresentationEditor { switch (eParamType) { - case ptFormula: { lValue = pManager.m_arResults[lValue]; break; } - case ptAdjust: { lValue = (*(pManager.m_pAdjustments))[lValue]; break; } + case ptFormula: + { + if (0 <= lValue && lValue < pManager.m_arResults.size()) + { + lValue = pManager.m_arResults[lValue]; + } + else + { + lValue = 0; + } + break; + } + case ptAdjust: + { + if (0 <= lValue && lValue < pManager.m_pAdjustments->size()) + { + lValue = (*(pManager.m_pAdjustments))[lValue]; + } + else + { + lValue = 0; + } + break; + } default: break; }; if (0 != m_arSlices.size()) -- 2.30.9