summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2018-02-27 16:17:04 +0000
committerMichael Stahl <mstahl@redhat.com>2018-02-27 20:15:52 +0100
commit7a1c0be8570e2be4a11f3e17c48c140b62245faa (patch)
tree2b97bdf685d727ee4e744b6b1a131142ab04544b
parent424eb9e4282596818ed39943b9d4a64cb6888eef (diff)
ofz#6576 check border param len
Change-Id: Ie479ef953b7c0f4a30afdafa27a9be121a346562 Reviewed-on: https://gerrit.libreoffice.org/50457 Reviewed-by: Michael Stahl <mstahl@redhat.com> Tested-by: Jenkins <ci@libreoffice.org>
-rw-r--r--sw/source/filter/ww8/ww8par.hxx2
-rw-r--r--sw/source/filter/ww8/ww8par2.cxx27
2 files changed, 25 insertions, 4 deletions
diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index 005d73d53b9b..12e4e37ccf66 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -1036,7 +1036,7 @@ struct WW8TabBandDesc
void ReadDef(bool bVer67, const sal_uInt8* pS, short nLen);
void ProcessDirection(const sal_uInt8* pParams);
void ProcessSprmTSetBRC(int nBrcVer, const sal_uInt8* pParamsTSetBRC);
- void ProcessSprmTTableBorders(int nBrcVer, const sal_uInt8* pParams);
+ void ProcessSprmTTableBorders(int nBrcVer, const sal_uInt8* pParams, sal_uInt16 nParamsLen);
void ProcessSprmTDxaCol(const sal_uInt8* pParamsTDxaCol);
void ProcessSprmTDelete(const sal_uInt8* pParamsTDelete);
void ProcessSprmTInsert(const sal_uInt8* pParamsTInsert);
diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index e72f71c39412..99662649fc0f 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -1405,11 +1405,16 @@ void WW8TabBandDesc::ProcessSprmTSetBRC(int nBrcVer, const sal_uInt8* pParamsTSe
}
}
-void WW8TabBandDesc::ProcessSprmTTableBorders(int nBrcVer, const sal_uInt8* pParams)
+void WW8TabBandDesc::ProcessSprmTTableBorders(int nBrcVer, const sal_uInt8* pParams, sal_uInt16 nParamsLen)
{
// sprmTTableBorders
if( nBrcVer == 6 )
{
+ if (nParamsLen < sizeof(WW8_BRCVer6) * 6)
+ {
+ SAL_WARN("sw.ww8", "table border property is too short");
+ return;
+ }
WW8_BRCVer6 const *pVer6 = reinterpret_cast<WW8_BRCVer6 const *>(pParams);
for (int i = 0; i < 6; ++i)
aDefBrcs[i] = WW8_BRCVer9(WW8_BRC(pVer6[i]));
@@ -1417,11 +1422,23 @@ void WW8TabBandDesc::ProcessSprmTTableBorders(int nBrcVer, const sal_uInt8* pPar
else if ( nBrcVer == 8 )
{
static_assert(sizeof (WW8_BRC) == 4, "this has to match the msword size");
+ if (nParamsLen < sizeof(WW8_BRC) * 6)
+ {
+ SAL_WARN("sw.ww8", "table border property is too short");
+ return;
+ }
for( int i = 0; i < 6; ++i )
aDefBrcs[i] = WW8_BRCVer9(reinterpret_cast<WW8_BRC const *>(pParams)[i]);
}
else
+ {
+ if (nParamsLen < sizeof( aDefBrcs ))
+ {
+ SAL_WARN("sw.ww8", "table border property is too short");
+ return;
+ }
memcpy( aDefBrcs, pParams, sizeof( aDefBrcs ) );
+ }
}
void WW8TabBandDesc::ProcessSprmTDxaCol(const sal_uInt8* pParamsTDxaCol)
@@ -1902,7 +1919,9 @@ WW8TabDesc::WW8TabDesc(SwWW8ImplReader* pIoClass, WW8_CP nStartCp) :
const sal_uInt8* pShadeSprm = nullptr;
const sal_uInt8* pNewShadeSprm = nullptr;
const sal_uInt8* pTableBorders = nullptr;
+ sal_uInt16 nTableBordersLen = 0;
const sal_uInt8* pTableBorders90 = nullptr;
+ sal_uInt16 nTableBorders90Len = 0;
std::vector<const sal_uInt8*> aTSetBrcs, aTSetBrc90s;
WW8_TablePos *pTabPos = nullptr;
@@ -1949,9 +1968,11 @@ WW8TabDesc::WW8TabDesc(SwWW8ImplReader* pIoClass, WW8_CP nStartCp) :
break;
case sprmTTableBorders:
pTableBorders = pParams; // process at end
+ nTableBordersLen = nLen;
break;
case sprmTTableBorders90:
pTableBorders90 = pParams; // process at end
+ nTableBorders90Len = nLen;
break;
case sprmTTableHeader:
// tdf#105570
@@ -2043,10 +2064,10 @@ WW8TabDesc::WW8TabDesc(SwWW8ImplReader* pIoClass, WW8_CP nStartCp) :
if (pNewShadeSprm)
pNewBand->ReadNewShd(pNewShadeSprm, bOldVer);
if (pTableBorders90)
- pNewBand->ProcessSprmTTableBorders(9, pTableBorders90);
+ pNewBand->ProcessSprmTTableBorders(9, pTableBorders90, nTableBorders90Len);
else if (pTableBorders)
pNewBand->ProcessSprmTTableBorders(bOldVer ? 6 : 8,
- pTableBorders);
+ pTableBorders, nTableBordersLen);
std::vector<const sal_uInt8*>::const_iterator iter;
for (iter = aTSetBrcs.begin(); iter != aTSetBrcs.end(); ++iter)
pNewBand->ProcessSprmTSetBRC(bOldVer ? 6 : 8, *iter);