summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Stahl <mstahl@redhat.com>2017-05-10 21:19:58 +0200
committerMichael Stahl <mstahl@redhat.com>2017-05-10 22:00:58 +0200
commit088b898856a82d7ac4851a6e7dfe4d189d881f8e (patch)
tree2cbef287160940de73131110758cb5f932b96012
parentdb7bddbff203cb624ba61f4f72b04d4de6253d4c (diff)
tdf#107709 filter: MSO2003XML import: fix invalid OLE lengths
The oleLength was -28160 for the bugdoc, so i guess the shifting of signed chars there is perhaps not ideal, better upcast and shift as unsigned. Change-Id: I068013a10e18043c1534c7c61be8ff8a5556d460
-rw-r--r--filter/source/xsltfilter/OleHandler.cxx10
1 files changed, 8 insertions, 2 deletions
diff --git a/filter/source/xsltfilter/OleHandler.cxx b/filter/source/xsltfilter/OleHandler.cxx
index 6564d2ea88a9..2f2bd04f9eef 100644
--- a/filter/source/xsltfilter/OleHandler.cxx
+++ b/filter/source/xsltfilter/OleHandler.cxx
@@ -117,8 +117,14 @@ namespace XSLT
{
return "Can not read the length.";
}
- int oleLength = (aLength[0] << 0) + (aLength[1] << 8)
- + (aLength[2] << 16) + (aLength[3] << 24);
+ sal_Int32 const oleLength = (static_cast<sal_uInt8>(aLength[0]) << 0U)
+ | (static_cast<sal_uInt8>(aLength[1]) << 8U)
+ | (static_cast<sal_uInt8>(aLength[2]) << 16U)
+ | (static_cast<sal_uInt8>(aLength[3]) << 24U);
+ if (oleLength < 0)
+ {
+ return "invalid oleLength";
+ }
Sequence<sal_Int8> content(oleLength);
//Read all bytes. The compressed length should less then the uncompressed length
readbytes = subStream->readBytes(content, oleLength);