diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-03-01 14:11:47 +0000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-04-23 20:43:51 +0200 |
| commit | 3f5c33f4bc1d0e367d12abb73a9f94484d290960 (patch) | |
| tree | 01f96e895dd5b025f2da13d8d6728faadc9b70a0 | |
| parent | a5a08883e961cf6a1c79b610b656b42dbe9460ee (diff) | |
ofz: oom on seeks past end of SvMemoryStream
cause it grows to fit if its a resizable stream
Change-Id: I28b42becdfc8eb591d19d2512cdc1f1ec32c3bbe
(cherry picked from commit a42d9c5b541d637dcf24086e30f341b30e03c4c7)
Reviewed-on: https://gerrit.libreoffice.org/34754
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit 19561b0a54d0753db860e3b06b7b2ebba45a801c)
(cherry picked from commit 6dc4a3b254e4cf852e7e1c4d17117df55e0c160b)
| -rw-r--r-- | lotuswordpro/source/filter/lwpfilter.cxx | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/lotuswordpro/source/filter/lwpfilter.cxx b/lotuswordpro/source/filter/lwpfilter.cxx index c77d2dee2b29..2038e84950f5 100644 --- a/lotuswordpro/source/filter/lwpfilter.cxx +++ b/lotuswordpro/source/filter/lwpfilter.cxx @@ -104,7 +104,7 @@ using namespace OpenStormBento; bool Decompress(SvStream *pCompressed, SvStream * & pOutDecompressed) { pCompressed->Seek(0); - std::unique_ptr<SvStream> aDecompressed(new SvMemoryStream(4096, 4096)); + std::unique_ptr<SvMemoryStream> aDecompressed(new SvMemoryStream(4096, 4096)); unsigned char buffer[512]; pCompressed->Read(buffer, 16); aDecompressed->Write(buffer, 16); @@ -132,6 +132,9 @@ using namespace OpenStormBento; while (sal_uInt32 iRead = pCompressed->Read(buffer, 512)) aDecompressed->Write(buffer, iRead); + // disable stream growing past its current size + aDecompressed->SetResizeOffset(0); + //transfer ownership of aDecompressed's ptr pOutDecompressed = aDecompressed.release(); return true; |