--- /dev/null	2010-11-21 14:10:31.532337349 +0100
+++ openoffice.org-3.2.1/ooo-build-3-2-1-4/patches/dev300/security-fixes-from-cws-os145.diff	2010-11-22 20:47:36.000000000 +0100
@@ -0,0 +1,103 @@
+diff --git a/svx/source/svdraw/svdfppt.cxx b/svx/source/svdraw/svdfppt.cxx
+--- svx/source/svdraw/svdfppt.cxx
++++ svx/source/svdraw/svdfppt.cxx
+@@ -1469,12 +1469,16 @@
+
+        if ( bOk )
+        {
+-               // PersistPtrs lesen (alle)
+-        nPersistPtrAnz = aUserEditAtom.nMaxPersistWritten + 1; // 1 mehr, damit ich immer direkt indizieren kann
+-        pPersistPtr = new UINT32[ nPersistPtrAnz ];                            // (die fangen naemlich eigentlich bei 1 an)
++        nPersistPtrAnz = aUserEditAtom.nMaxPersistWritten + 1;
++               if ( ( nPersistPtrAnz >> 2 ) > nStreamLen )             // sj: at least nPersistPtrAnz is not allowed to be greater than filesize
++                       bOk = FALSE;                                                            // (it should not be greater than the PPT_PST_PersistPtrIncrementalBlock, but
++                                                                                                               // we are reading this block later, so we do not have access yet)
++
++               if ( bOk && ( nPersistPtrAnz < ( SAL_MAX_UINT32 / sizeof( UINT32 ) ) ) )
++                       pPersistPtr = new (std::nothrow) UINT32[ nPersistPtrAnz ];
+                if ( !pPersistPtr )
+                        bOk = FALSE;
+-               else
++               if ( bOk )
+                {
+                        memset( pPersistPtr, 0x00, nPersistPtrAnz * 4 );
+
+diff --git a/vcl/source/gdi/pngread.cxx b/vcl/source/gdi/pngread.cxx
+--- vcl/source/gdi/pngread.cxx
++++ vcl/source/gdi/pngread.cxx
+@@ -411,7 +411,9 @@
+ 
+ 			case PNGCHUNK_IDAT :
+ 			{
+-				if ( !mbIDAT )		// the gfx is finished, but there may be left a zlibCRC of about 4Bytes
++				if ( !mpInflateInBuf )	// taking care that the header has properly been read
++					mbStatus = FALSE;
++				else if ( !mbIDAT )		// the gfx is finished, but there may be left a zlibCRC of about 4Bytes
+ 					ImplReadIDAT();
+ 			}
+ 			break;
+@@ -527,7 +529,7 @@
+ 	mbIDAT = mbAlphaChannel = mbTransparent = FALSE;
+ 	mbGrayScale = mbRGBTriple = FALSE;
+ 	mnTargetDepth = mnPngDepth;
+-	mnScansize = ( ( maOrigSize.Width() * mnPngDepth ) + 7 ) >> 3;
++	sal_uInt64 nScansize64 = ( ( static_cast< sal_uInt64 >( maOrigSize.Width() ) * mnPngDepth ) + 7 ) >> 3;
+ 
+ 	// valid color types are 0,2,3,4 & 6
+ 	switch ( mnColorType )
+@@ -557,7 +559,7 @@
+ 		case 2 :	// each pixel is an RGB triple
+ 		{
+ 			mbRGBTriple = TRUE;
+-			mnScansize *= 3;
++			nScansize64 *= 3;
+ 			switch ( mnPngDepth )
+ 			{
+ 				case 16 :			// we have to reduce the bitmap
+@@ -590,7 +592,7 @@
+ 
+ 		case 4 :	// each pixel is a grayscale sample followed by an alpha sample
+ 		{
+-			mnScansize *= 2;
++			nScansize64 *= 2;
+ 			mbAlphaChannel = TRUE;
+ 			switch ( mnPngDepth )
+ 			{
+@@ -608,7 +610,7 @@
+ 		case 6 :	// each pixel is an RGB triple followed by an alpha sample
+ 		{
+ 			mbRGBTriple = TRUE;
+-			mnScansize *= 4;
++			nScansize64 *= 4;
+ 			mbAlphaChannel = TRUE;
+ 			switch (mnPngDepth )
+ 			{
+@@ -626,16 +628,24 @@
+ 			return FALSE;
+ 	}
+ 
+-    mnBPP = mnScansize / maOrigSize.Width();
++    mnBPP = static_cast< sal_uInt32 >( nScansize64 / maOrigSize.Width() );
+     if ( !mnBPP )
+         mnBPP = 1;
+ 
+-    mnScansize++;       // each scanline includes one filterbyte
++    nScansize64++;       // each scanline includes one filterbyte
++
++	if ( nScansize64 > SAL_MAX_UINT32 )
++		return FALSE;
++
++	mnScansize = static_cast< sal_uInt32 >( nScansize64 );
+ 
+     // TODO: switch between both scanlines instead of copying
+-    mpInflateInBuf = new BYTE[ mnScansize ];
++	mpInflateInBuf = new (std::nothrow) BYTE[ mnScansize ];
+     mpScanCurrent = mpInflateInBuf;
+-    mpScanPrior = new BYTE[ mnScansize ];
++	mpScanPrior = new (std::nothrow) BYTE[ mnScansize ];
++
++	if ( !mpInflateInBuf || !mpScanPrior )
++		return FALSE;
+ 
+     // calculate target size from original size and the preview hint
+     if( rPreviewSizeHint.Width() || rPreviewSizeHint.Height() )
--- openoffice.org-3.2.1/ooo-build-3-2-1-4/patches/dev300/apply-old	2010-11-22 20:01:52.000000000 +0100
+++ openoffice.org-3.2.1/ooo-build-3-2-1-4/patches/dev300/apply	2010-11-22 20:02:06.000000000 +0100
@@ -4096,3 +4096,4 @@
 [ Security ]
 SA40775.diff
 cws-hb22.diff
+security-fixes-from-cws-os145.diff
