Resolves: tdf#116999 fix reading cgm text at record bounds

Change-Id: Ibbff7b0a3c3447135e0f6c585914dc6018e51765
Reviewed-on: https://gerrit.libreoffice.org/52951
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

4 files changed, 9 insertions, 13 deletions

diff --git a/filter/source/graphicfilter/icgm/actimpr.cxx b/filter/source/graphicfilter/icgm/actimpr.cxx
index fc701f64f570..c685ce513269 100644
--- a/filter/source/graphicfilter/icgm/actimpr.cxx
+++ b/filter/source/graphicfilter/icgm/actimpr.cxx
@@ -713,7 +713,7 @@ void CGMImpressOutAct::DrawPolyPolygon( tools::PolyPolygon const & rPolyPolygon
     }
 }
 
-void CGMImpressOutAct::DrawText( awt::Point const & rTextPos, awt::Size const & rTextSize, char const * pString, FinalFlag eFlag )
+void CGMImpressOutAct::DrawText(awt::Point const & rTextPos, awt::Size const & rTextSize, const OUString& rString, FinalFlag eFlag)
 {
     if ( ImplCreateShape( "com.sun.star.drawing.TextShape" ) )
     {
@@ -803,8 +803,6 @@ void CGMImpressOutAct::DrawText( awt::Point const & rTextPos, awt::Size const &
         uno::Any aFirstQuery( maXShape->queryInterface( cppu::UnoType<text::XText>::get()));
         if( aFirstQuery >>= xText )
         {
-            OUString aStr(pString, strlen(pString), RTL_TEXTENCODING_ASCII_US);
-
             uno::Reference< text::XTextCursor >  aXTextCursor( xText->createTextCursor() );
             {
                 aXTextCursor->gotoEnd( false );
@@ -840,7 +838,7 @@ void CGMImpressOutAct::DrawText( awt::Point const & rTextPos, awt::Size const &
                             aAny <<= true;
                             maXPropSet->setPropertyValue( "TextFitToSize", aAny );
                         }
-                        aCursorText->setString( aStr );
+                        aCursorText->setString(rString);
                         aXTextCursor->gotoEnd( true );
                         ImplSetTextBundle( aCursorPropSet );
                     }
diff --git a/filter/source/graphicfilter/icgm/class4.cxx b/filter/source/graphicfilter/icgm/class4.cxx
index 4db70a8acbc5..a7779ab23d49 100644
--- a/filter/source/graphicfilter/icgm/class4.cxx
+++ b/filter/source/graphicfilter/icgm/class4.cxx
@@ -184,15 +184,14 @@ void CGM::ImplDoClass4()
                 sal_uInt32 nType = ImplGetUI16();
                 sal_uInt32 nSize = ImplGetUI( 1 );
 
-                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
+                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
                     throw css::uno::Exception("attempt to read past end of input", nullptr);
 
-                mpSource[mnParaSize + nSize] = 0;
+                OUString aStr(reinterpret_cast<char*>(mpSource) + mnParaSize, nSize, RTL_TEXTENCODING_ASCII_US);
 
                 awt::Size aSize;
                 awt::Point aPoint( static_cast<long>(aFloatPoint.X), static_cast<long>(aFloatPoint.Y) );
-                mpOutAct->DrawText( aPoint, aSize,
-                                reinterpret_cast<char*>(mpSource) + mnParaSize, static_cast<FinalFlag>(nType) );
+                mpOutAct->DrawText(aPoint, aSize, aStr, static_cast<FinalFlag>(nType));
                 mnParaSize = mnElementSize;
             }
             break;
@@ -222,15 +221,14 @@ void CGM::ImplDoClass4()
                 sal_uInt32 nType = ImplGetUI16();
                 sal_uInt32 nSize = ImplGetUI(1);
 
-                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
+                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
                     throw css::uno::Exception("attempt to read past end of input", nullptr);
 
-                mpSource[ mnParaSize + nSize ] = 0;
+                OUString aStr(reinterpret_cast<char*>(mpSource) + mnParaSize, nSize, RTL_TEXTENCODING_ASCII_US);
 
                 awt::Point aPoint( static_cast<long>(aFloatPoint.X), static_cast<long>(aFloatPoint.Y) );
                 awt::Size aSize(static_cast<long>(dx), static_cast<long>(dy));
-                mpOutAct->DrawText( aPoint, aSize ,
-                                reinterpret_cast<char*>(mpSource) + mnParaSize, static_cast<FinalFlag>(nType) );
+                mpOutAct->DrawText(aPoint, aSize , aStr, static_cast<FinalFlag>(nType));
                 mnParaSize = mnElementSize;
             }
             break;
diff --git a/filter/source/graphicfilter/icgm/outact.hxx b/filter/source/graphicfilter/icgm/outact.hxx
index 4ec1090e5185..a31d42c4560a 100644
--- a/filter/source/graphicfilter/icgm/outact.hxx
+++ b/filter/source/graphicfilter/icgm/outact.hxx
@@ -91,7 +91,7 @@ public:
     void                        DrawPolyLine( tools::Polygon& );
     void                        DrawPolybezier( tools::Polygon& );
     void                        DrawPolyPolygon( tools::PolyPolygon const & );
-    void                        DrawText( css::awt::Point const & TextRectPos, css::awt::Size const & TextRectSize, char const * String, FinalFlag );
+    void                        DrawText(css::awt::Point const & TextRectPos, css::awt::Size const & TextRectSize, const OUString& rString, FinalFlag);
     void                        AppendText( const char* String );
 
     void                        FirstOutPut() { mpCGM->mbFirstOutPut = false; } ;
diff --git a/sd/qa/unit/data/cgm/pass/binary_corvette.cgm b/sd/qa/unit/data/cgm/pass/binary_corvette.cgm
new file mode 100644
index 000000000000..2b38c48345d3
--- /dev/null
+++ b/sd/qa/unit/data/cgm/pass/binary_corvette.cgm