avoid infinite loop when parsing malformed ooxml math (fdo#57886)

Change-Id: I2f66bc335795a9e84f532fb28d3585aed783ebd6

2 files changed, 5 insertions, 5 deletions

diff --git a/starmath/source/ooxmlimport.cxx b/starmath/source/ooxmlimport.cxx
index c83fc9b26209..0b1bedad3315 100644
--- a/starmath/source/ooxmlimport.cxx
+++ b/starmath/source/ooxmlimport.cxx
@@ -69,7 +69,7 @@ OUString SmOoxmlImport::handleStream()
     {
         // strictly speaking, it is not OMathArg here, but currently supported
         // functionality is the same like OMathArg, in the future this may need improving
-        OUString item = readOMathArg();
+        OUString item = readOMathArg( M_TOKEN( oMath ));
         if( item.isEmpty())
             continue;
         if( !ret.isEmpty())
@@ -87,10 +87,10 @@ OUString SmOoxmlImport::handleStream()
     return ret;
 }
 
-OUString SmOoxmlImport::readOMathArg()
+OUString SmOoxmlImport::readOMathArg( int stoptoken )
 {
     OUString ret;
-    while( !stream.atEnd() && stream.currentToken() != CLOSING( stream.currentToken()))
+    while( !stream.atEnd() && stream.currentToken() != CLOSING( stoptoken ))
     {
         if( !ret.isEmpty())
             ret += " ";
@@ -164,7 +164,7 @@ OUString SmOoxmlImport::readOMathArg()
 OUString SmOoxmlImport::readOMathArgInElement( int token )
 {
     stream.ensureOpeningTag( token );
-    OUString ret = readOMathArg();
+    OUString ret = readOMathArg( token );
     stream.ensureClosingTag( token );
     return ret;
 }
diff --git a/starmath/source/ooxmlimport.hxx b/starmath/source/ooxmlimport.hxx
index bdb83482c57f..6e4835dd4c99 100644
--- a/starmath/source/ooxmlimport.hxx
+++ b/starmath/source/ooxmlimport.hxx
@@ -63,7 +63,7 @@ private:
     OUString handleSsub();
     OUString handleSsubsup();
     OUString handleSsup();
-    OUString readOMathArg();
+    OUString readOMathArg( int stoptoken );
     OUString readOMathArgInElement( int token );
     oox::formulaimport::XmlStream& stream;
 };