diff options
author | Caolán McNamara <caolanm@redhat.com> | 2015-04-13 12:46:34 +0100 |
---|---|---|
committer | Andras Timar <andras.timar@collabora.com> | 2015-04-16 23:06:56 +0200 |
commit | 963b2dbd0fe10e7533bed4c284bcf4ecaf6d827d (patch) | |
tree | 9a792fd9b716a3f8d19d99e89a82b9627faaf33d /filter/source/msfilter | |
parent | 83d04b17e131663d6ecf4e6c631ada2ade463df8 (diff) |
Related: tdf#74018 fix int wraparound + crash on export
of fdo74018-2.docx to doc
nPoints is 16bit and accumulated value wraps around, so use
a 32bit nTotalPoints instead and move 16bit declarations to
use points to confirm no other wraparounds
(cherry picked from commit ce705ac56a8709970356d634abb964adef105594)
Change-Id: If97ccb46ed8eb7f4305cdfe328ae83bc2b0c778c
Reviewed-on: https://gerrit.libreoffice.org/15280
Tested-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Diffstat (limited to 'filter/source/msfilter')
-rw-r--r-- | filter/source/msfilter/escherex.cxx | 37 |
1 files changed, 19 insertions, 18 deletions
diff --git a/filter/source/msfilter/escherex.cxx b/filter/source/msfilter/escherex.cxx index 23fcc48aa218..517b548fd292 100644 --- a/filter/source/msfilter/escherex.cxx +++ b/filter/source/msfilter/escherex.cxx @@ -2056,42 +2056,43 @@ bool EscherPropertyContainer::CreatePolygonProperties( { Polygon aPolygon; - sal_uInt16 i, j, k, nPoints, nBezPoints, nPolyCount = aPolyPolygon.Count(); + sal_uInt16 nPolyCount = aPolyPolygon.Count(); + sal_uInt32 nTotalPoints(0), nTotalBezPoints(0); Rectangle aRect( aPolyPolygon.GetBoundRect() ); rGeoRect = ::com::sun::star::awt::Rectangle( aRect.Left(), aRect.Top(), aRect.GetWidth(), aRect.GetHeight() ); - for ( nBezPoints = nPoints = i = 0; i < nPolyCount; i++ ) + for (sal_uInt16 i = 0; i < nPolyCount; ++i) { - k = aPolyPolygon[ i ].GetSize(); - nPoints = nPoints + k; - for ( j = 0; j < k; j++ ) + sal_uInt16 k = aPolyPolygon[ i ].GetSize(); + nTotalPoints += k; + for (sal_uInt16 j = 0; j < k; ++j) { if ( aPolyPolygon[ i ].GetFlags( j ) != POLY_CONTROL ) - nBezPoints++; + nTotalBezPoints++; } } - sal_uInt32 nVerticesBufSize = ( nPoints << 2 ) + 6; + sal_uInt32 nVerticesBufSize = ( nTotalPoints << 2 ) + 6; sal_uInt8* pVerticesBuf = new sal_uInt8[ nVerticesBufSize ]; - sal_uInt32 nSegmentBufSize = ( ( nBezPoints << 2 ) + 8 ); + sal_uInt32 nSegmentBufSize = ( ( nTotalBezPoints << 2 ) + 8 ); if ( nPolyCount > 1 ) nSegmentBufSize += ( nPolyCount << 1 ); sal_uInt8* pSegmentBuf = new sal_uInt8[ nSegmentBufSize ]; sal_uInt8* pPtr = pVerticesBuf; - *pPtr++ = (sal_uInt8)( nPoints ); // Little endian - *pPtr++ = (sal_uInt8)( nPoints >> 8 ); - *pPtr++ = (sal_uInt8)( nPoints ); - *pPtr++ = (sal_uInt8)( nPoints >> 8 ); + *pPtr++ = (sal_uInt8)( nTotalPoints ); // Little endian + *pPtr++ = (sal_uInt8)( nTotalPoints >> 8 ); + *pPtr++ = (sal_uInt8)( nTotalPoints ); + *pPtr++ = (sal_uInt8)( nTotalPoints >> 8 ); *pPtr++ = (sal_uInt8)0xf0; *pPtr++ = (sal_uInt8)0xff; - for ( j = 0; j < nPolyCount; j++ ) + for (sal_uInt16 j = 0; j < nPolyCount; ++j) { aPolygon = aPolyPolygon[ j ]; - nPoints = aPolygon.GetSize(); - for ( i = 0; i < nPoints; i++ ) // write points from polygon to buffer + sal_uInt16 nPoints = aPolygon.GetSize(); + for (sal_uInt16 i = 0; i < nPoints; ++i) // write points from polygon to buffer { Point aPoint = aPolygon[ i ]; aPoint.X() -= rGeoRect.X; @@ -2112,13 +2113,13 @@ bool EscherPropertyContainer::CreatePolygonProperties( *pPtr++ = (sal_uInt8)2; *pPtr++ = (sal_uInt8)0; - for ( j = 0; j < nPolyCount; j++ ) + for (sal_uInt16 j = 0; j < nPolyCount; ++j) { *pPtr++ = 0x0; // Polygon start *pPtr++ = 0x40; aPolygon = aPolyPolygon[ j ]; - nPoints = aPolygon.GetSize(); - for ( i = 0; i < nPoints; i++ ) // write Polyflags to Buffer + sal_uInt16 nPoints = aPolygon.GetSize(); + for (sal_uInt16 i = 0; i < nPoints; ++i) // write Polyflags to Buffer { *pPtr++ = 0; if ( bBezier ) |