Bug-Ubuntu: https://bugs.launchpad.net/allston/+bug/1110469
Applied-Upstream: http://cgit.freedesktop.org/libreoffice/core/commit/?id=e1dee0aaacd8e30e2949053ebf351d76bad14ac3 http://cgit.freedesktop.org/libreoffice/core/commit/?id=1ca1a7aa9935ad33325ac7aebbbb127995337988
From 9dd2c8ec4992516f0e6b3e4a98eda89ab8abc579 Mon Sep 17 00:00:00 2001
From: Markus Mohrhard <markus.mohrhard@googlemail.com>
Date: Thu, 04 Oct 2012 17:55:04 +0000
Subject: limit degree for b-spline to 15 to prevent std::bad_alloc, fdo#46100

Change-Id: Ib801c6af84b52ed093be2ba5eba902513bfa4070
Signed-off-by: Kohei Yoshida <kohei.yoshida@gmail.com>
---
diff --git a/chart2/source/view/charttypes/Splines.cxx b/chart2/source/view/charttypes/Splines.cxx
index 5f29c41..eac5b4a 100644
--- a/chart2/source/view/charttypes/Splines.cxx
+++ b/chart2/source/view/charttypes/Splines.cxx
@@ -35,6 +35,8 @@
 #include <algorithm>
 #include <functional>
 
+#define MAX_BSPLINE_DEGREE 15
+
 //.............................................................................
 namespace chart
 {
@@ -702,7 +704,9 @@ void SplineCalculater::CalculateBSplines(
     // ODF1.2 spec variable p
     OSL_ASSERT( nResolution > 1 );
     OSL_ASSERT( nDegree >= 1 );
-    sal_uInt32 p = nDegree;
+
+    // limit the b-spline degree to prevent insanely large sets of points
+    sal_uInt32 p = std::min<sal_uInt32>(nDegree, MAX_BSPLINE_DEGREE);
 
     rResult.SequenceX.realloc(0);
     rResult.SequenceY.realloc(0);

diff --git a/chart2/source/controller/dialogs/tp_ChartType.src b/chart2/source/controller/dialogs/tp_ChartType.src
index 049ef89..0f4966a 100644
--- a/chart2/source/controller/dialogs/tp_ChartType.src
+++ b/chart2/source/controller/dialogs/tp_ChartType.src
@@ -257,11 +257,11 @@ ModalDialog DLG_SPLINE_PROPERTIES
         Repeat = TRUE ;
         Spin = TRUE ;
         Minimum = 1 ;
-        Maximum = 100 ;
+        Maximum = 15 ;
         StrictFormat = TRUE ;
         Unit = FUNIT_CUSTOM ;
         First = 1 ;
-        Last = 100 ;
+        Last = 15 ;
         SpinSize = 1 ;
     };
     FixedLine FL_SPLINE_DIALOGBUTTONS
--
cgit v0.9.0.2-2-gbebe

