diff options
author | Caolán McNamara <caolanm@redhat.com> | 2015-04-13 12:46:34 +0100 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2015-04-13 12:48:41 +0100 |
commit | ce705ac56a8709970356d634abb964adef105594 (patch) | |
tree | 339330f1497b86a35d619767513e2cff1594fe6c /filter/source | |
parent | a4b11f03187056248643c1f5deb7f3645a6570b7 (diff) |
fix int wraparound + crash on export of fdo74018-2.docx to doc
nPoints is 16bit and accumulated value wraps around, so use
a 32bit nTotalPoints instead and move 16bit declarations to
use points to confirm no other wraparounds
Change-Id: If97ccb46ed8eb7f4305cdfe328ae83bc2b0c778c
Diffstat (limited to 'filter/source')
-rw-r--r-- | filter/source/msfilter/escherex.cxx | 37 |
1 files changed, 19 insertions, 18 deletions
diff --git a/filter/source/msfilter/escherex.cxx b/filter/source/msfilter/escherex.cxx index 22bb0f0d5352..67680c0e1f81 100644 --- a/filter/source/msfilter/escherex.cxx +++ b/filter/source/msfilter/escherex.cxx @@ -2056,42 +2056,43 @@ bool EscherPropertyContainer::CreatePolygonProperties( { Polygon aPolygon; - sal_uInt16 i, j, k, nPoints, nBezPoints, nPolyCount = aPolyPolygon.Count(); + sal_uInt16 nPolyCount = aPolyPolygon.Count(); + sal_uInt32 nTotalPoints(0), nTotalBezPoints(0); Rectangle aRect( aPolyPolygon.GetBoundRect() ); rGeoRect = ::com::sun::star::awt::Rectangle( aRect.Left(), aRect.Top(), aRect.GetWidth(), aRect.GetHeight() ); - for ( nBezPoints = nPoints = i = 0; i < nPolyCount; i++ ) + for (sal_uInt16 i = 0; i < nPolyCount; ++i) { - k = aPolyPolygon[ i ].GetSize(); - nPoints = nPoints + k; - for ( j = 0; j < k; j++ ) + sal_uInt16 k = aPolyPolygon[ i ].GetSize(); + nTotalPoints += k; + for (sal_uInt16 j = 0; j < k; ++j) { if ( aPolyPolygon[ i ].GetFlags( j ) != POLY_CONTROL ) - nBezPoints++; + nTotalBezPoints++; } } - sal_uInt32 nVerticesBufSize = ( nPoints << 2 ) + 6; + sal_uInt32 nVerticesBufSize = ( nTotalPoints << 2 ) + 6; sal_uInt8* pVerticesBuf = new sal_uInt8[ nVerticesBufSize ]; - sal_uInt32 nSegmentBufSize = ( ( nBezPoints << 2 ) + 8 ); + sal_uInt32 nSegmentBufSize = ( ( nTotalBezPoints << 2 ) + 8 ); if ( nPolyCount > 1 ) nSegmentBufSize += ( nPolyCount << 1 ); sal_uInt8* pSegmentBuf = new sal_uInt8[ nSegmentBufSize ]; sal_uInt8* pPtr = pVerticesBuf; - *pPtr++ = (sal_uInt8)( nPoints ); // Little endian - *pPtr++ = (sal_uInt8)( nPoints >> 8 ); - *pPtr++ = (sal_uInt8)( nPoints ); - *pPtr++ = (sal_uInt8)( nPoints >> 8 ); + *pPtr++ = (sal_uInt8)( nTotalPoints ); // Little endian + *pPtr++ = (sal_uInt8)( nTotalPoints >> 8 ); + *pPtr++ = (sal_uInt8)( nTotalPoints ); + *pPtr++ = (sal_uInt8)( nTotalPoints >> 8 ); *pPtr++ = (sal_uInt8)0xf0; *pPtr++ = (sal_uInt8)0xff; - for ( j = 0; j < nPolyCount; j++ ) + for (sal_uInt16 j = 0; j < nPolyCount; ++j) { aPolygon = aPolyPolygon[ j ]; - nPoints = aPolygon.GetSize(); - for ( i = 0; i < nPoints; i++ ) // write points from polygon to buffer + sal_uInt16 nPoints = aPolygon.GetSize(); + for (sal_uInt16 i = 0; i < nPoints; ++i) // write points from polygon to buffer { Point aPoint = aPolygon[ i ]; aPoint.X() -= rGeoRect.X; @@ -2112,13 +2113,13 @@ bool EscherPropertyContainer::CreatePolygonProperties( *pPtr++ = (sal_uInt8)2; *pPtr++ = (sal_uInt8)0; - for ( j = 0; j < nPolyCount; j++ ) + for (sal_uInt16 j = 0; j < nPolyCount; ++j) { *pPtr++ = 0x0; // Polygon start *pPtr++ = 0x40; aPolygon = aPolyPolygon[ j ]; - nPoints = aPolygon.GetSize(); - for ( i = 0; i < nPoints; i++ ) // write Polyflags to Buffer + sal_uInt16 nPoints = aPolygon.GetSize(); + for (sal_uInt16 i = 0; i < nPoints; ++i) // write Polyflags to Buffer { *pPtr++ = 0; if ( bBezier ) |