diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-08-31 11:11:27 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2015-09-04 17:11:18 +0200 |
| commit | 8d471ba56d413adb177214af2434b2b6f54b0a4e (patch) | |
| tree | af5ef707b291a8e3444ed047a1b41f0d300161d3 /filter/source/graphicfilter/ios2met/ios2met.cxx | |
| parent | 5d210fba65ec1cc145366117da5fecd349d4fada (diff) | |
check for legal field sizes before reading
Change-Id: I3cdb647e1a057be5bb4b32d119ee5bcbbedf7473
(cherry picked from commit ad6d83defb33c414885ce6d4bfa85571d463f3c3)
Reviewed-on: https://gerrit.libreoffice.org/18170
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
Tested-by: Miklos Vajna <vmiklos@collabora.co.uk>
Diffstat (limited to 'filter/source/graphicfilter/ios2met/ios2met.cxx')
| -rw-r--r-- | filter/source/graphicfilter/ios2met/ios2met.cxx | 25 |
1 files changed, 19 insertions, 6 deletions
diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx index e0d8736929d4..88cc418874de 100644 --- a/filter/source/graphicfilter/ios2met/ios2met.cxx +++ b/filter/source/graphicfilter/ios2met/ios2met.cxx @@ -2678,21 +2678,34 @@ void OS2METReader::ReadOS2MET( SvStream & rStreamOS2MET, GDIMetaFile & rGDIMetaF pOS2MET->ReadUInt16(nFieldType); pOS2MET->SeekRel(3); - nPos+=8; nFieldSize-=8; - if (pOS2MET->GetError()) break; - if (pOS2MET->IsEof()) { + if (pOS2MET->GetError()) + break; + + if (nFieldType==EndDocumnMagic) + break; + + if (pOS2MET->IsEof() || nFieldSize < 8) + { pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR); ErrorCode=8; break; } - if (nFieldType==EndDocumnMagic) break; + nPos+=8; nFieldSize-=8; + + if (nFieldSize > pOS2MET->remainingSize()) + { + pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR); + ErrorCode=8; + break; + } ReadField(nFieldType, nFieldSize); + nPos += nFieldSize; - nPos+=(sal_uLong)nFieldSize; - if (pOS2MET->Tell()>nPos) { + if (pOS2MET->Tell() > nPos) + { pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR); ErrorCode=9; break; |