diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-08-18 12:07:27 +0100 |
|---|---|---|
| committer | Markus Mohrhard <markus.mohrhard@googlemail.com> | 2014-08-18 07:17:05 -0500 |
| commit | c80754dac761b8489250c1ede510fb76b98cc590 (patch) | |
| tree | 234d178af5d4d237418a8a4e89c27b41fe9fac62 | |
| parent | a501f64beb4e37330764a2f5c091685f2ca9359f (diff) | |
check len before memcpying into it
valgrind + bff on sf_3e0068c9b19bb548826bed0599f65745-CrdWMI-minimized.gif
Change-Id: I74cc21609f1c97a27e13615593f678cbbc8463e3
(cherry picked from commit d4e64d030092984077021a9af9d281cd64c476bf)
Reviewed-on: https://gerrit.libreoffice.org/10991
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Tested-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
| -rw-r--r-- | connectivity/source/drivers/dbase/DTable.cxx | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/connectivity/source/drivers/dbase/DTable.cxx b/connectivity/source/drivers/dbase/DTable.cxx index 9dd02ba42865..603619417aa9 100644 --- a/connectivity/source/drivers/dbase/DTable.cxx +++ b/connectivity/source/drivers/dbase/DTable.cxx @@ -799,6 +799,7 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool (*aIter)->getPropertyValue(OMetaConnection::getPropMap().getNameByIndex(PROPERTY_ID_PRECISION)) >>= nLen; (*aIter)->getPropertyValue(OMetaConnection::getPropMap().getNameByIndex(PROPERTY_ID_TYPE)) >>= nType; } + switch(nType) { case DataType::INTEGER: @@ -875,6 +876,8 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool else if ( DataType::INTEGER == nType ) { sal_Int32 nValue = 0; + if (static_cast<size_t>(nLen) > sizeof(nValue)) + return false; memcpy(&nValue, pData, nLen); *(_rRow->get())[i] = nValue; } @@ -884,6 +887,8 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool if (getBOOL((*aIter)->getPropertyValue(OMetaConnection::getPropMap().getNameByIndex(PROPERTY_ID_ISCURRENCY)))) // Currency is treated separately { sal_Int64 nValue = 0; + if (static_cast<size_t>(nLen) > sizeof(nValue)) + return false; memcpy(&nValue, pData, nLen); if ( m_aScales[i-1] ) @@ -893,6 +898,8 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool } else { + if (static_cast<size_t>(nLen) > sizeof(d)) + return false; memcpy(&d, pData, nLen); } @@ -1852,6 +1859,8 @@ bool ODbaseTable::UpdateBuffer(OValueRefVector& rRow, OValueRefRow pOrgRow, cons case DataType::INTEGER: { sal_Int32 nValue = thisColVal; + if (static_cast<size_t>(nLen) > sizeof(nValue)) + return false; memcpy(pData,&nValue,nLen); } break; @@ -1867,10 +1876,16 @@ bool ODbaseTable::UpdateBuffer(OValueRefVector& rRow, OValueRefRow pOrgRow, cons nValue = (sal_Int64)(d * pow(10.0,(int)m_aScales[i])); else nValue = (sal_Int64)(d); + if (static_cast<size_t>(nLen) > sizeof(nValue)) + return false; memcpy(pData,&nValue,nLen); } // if (getBOOL(xCol->getPropertyValue(OMetaConnection::getPropMap().getNameByIndex(PROPERTY_ID_ISCURRENCY)))) // Currency is treated separately else + { + if (static_cast<size_t>(nLen) > sizeof(d)) + return false; memcpy(pData,&d,nLen); + } } break; case DataType::DECIMAL: |