diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-07-15 12:59:55 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2015-08-03 17:51:25 +0200 |
| commit | 5d01ab78f3912983e09bfc29a442d1d999e7e3e3 (patch) | |
| tree | 436e7e8e1e756bc0b00fbcc104a55b268774ebac /filter/source/graphicfilter | |
| parent | 7a7f7298d20d332ee4b3dc8fd27ddd9a6b8c4c48 (diff) | |
tools polygons limited to 16bit indexes
(cherry picked from commit 89857aacac98f0f8e5dca4718affec493951f904)
WaE: C2220
(cherry picked from commit 8547c336b3253d90daae1c79a2b1a57996a39102)
Change-Id: Ib0f727a3681492c15b807ca159d8bf7675ee8f29
Reviewed-on: https://gerrit.libreoffice.org/17089
Reviewed-by: Michael Meeks <michael.meeks@collabora.com>
Tested-by: Michael Meeks <michael.meeks@collabora.com>
Diffstat (limited to 'filter/source/graphicfilter')
| -rw-r--r-- | filter/source/graphicfilter/ios2met/ios2met.cxx | 33 |
1 files changed, 26 insertions, 7 deletions
diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx index 1b7700bb40c4..e0d8736929d4 100644 --- a/filter/source/graphicfilter/ios2met/ios2met.cxx +++ b/filter/source/graphicfilter/ios2met/ios2met.cxx @@ -1190,18 +1190,37 @@ void OS2METReader::ReadPartialArc(bool bGivenPos, sal_uInt16 nOrderSize) void OS2METReader::ReadPolygons() { - sal_uInt32 i,j,nNumPolys, nNumPoints; tools::PolyPolygon aPolyPoly; Polygon aPoly; Point aPoint; - sal_uInt8 nFlags; - pOS2MET->ReadUChar( nFlags ).ReadUInt32( nNumPolys ); - for (i=0; i<nNumPolys; i++) { - pOS2MET->ReadUInt32( nNumPoints ); - if (i==0) nNumPoints++; + sal_uInt8 nFlags(0); + sal_uInt32 nNumPolys(0); + pOS2MET->ReadUChar(nFlags).ReadUInt32(nNumPolys); + + if (nNumPolys > SAL_MAX_UINT16) + { + pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR); + ErrorCode=11; + return; + } + + for (sal_uInt32 i=0; i<nNumPolys; ++i) + { + sal_uInt32 nNumPoints(0); + pOS2MET->ReadUInt32(nNumPoints); + sal_uInt32 nLimit = SAL_MAX_UINT16; + if (i==0) --nLimit; + if (nNumPoints > nLimit) + { + pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR); + ErrorCode=11; + return; + } + if (i==0) ++nNumPoints; aPoly.SetSize((short)nNumPoints); - for (j=0; j<nNumPoints; j++) { + for (sal_uInt32 j=0; j<nNumPoints; ++j) + { if (i==0 && j==0) aPoint=aAttr.aCurPos; else aPoint=ReadPoint(); aPoly.SetPoint(aPoint,(short)j); |