Resolves: tdf#116999 fix reading cgm text at record bounds

Change-Id: Ibbff7b0a3c3447135e0f6c585914dc6018e51765
Reviewed-on: https://gerrit.libreoffice.org/52952
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
(cherry picked from commit a0c008175eee894f6b4a8975d6c0b4bec2592d08)

3 files changed, 9 insertions, 13 deletions

diff --git a/filter/source/graphicfilter/icgm/actimpr.cxx b/filter/source/graphicfilter/icgm/actimpr.cxx
index 9a0762905bab..7be62849f588 100644
--- a/filter/source/graphicfilter/icgm/actimpr.cxx
+++ b/filter/source/graphicfilter/icgm/actimpr.cxx
@@ -706,7 +706,7 @@ void CGMImpressOutAct::DrawPolyPolygon( tools::PolyPolygon const & rPolyPolygon
     }
 }
 
-void CGMImpressOutAct::DrawText( awt::Point const & rTextPos, awt::Size const & rTextSize, char const * pString, FinalFlag eFlag )
+void CGMImpressOutAct::DrawText(awt::Point const & rTextPos, awt::Size const & rTextSize, const OUString& rString, FinalFlag eFlag)
 {
     if ( ImplCreateShape( "com.sun.star.drawing.TextShape" ) )
     {
@@ -796,8 +796,6 @@ void CGMImpressOutAct::DrawText( awt::Point const & rTextPos, awt::Size const &
         uno::Any aFirstQuery( maXShape->queryInterface( cppu::UnoType<text::XText>::get()));
         if( aFirstQuery >>= xText )
         {
-            OUString aStr(pString, rtl_str_getLength(pString), RTL_TEXTENCODING_ASCII_US);
-
             uno::Reference< text::XTextCursor >  aXTextCursor( xText->createTextCursor() );
             {
                 aXTextCursor->gotoEnd( false );
@@ -833,7 +831,7 @@ void CGMImpressOutAct::DrawText( awt::Point const & rTextPos, awt::Size const &
                             aAny <<= true;
                             maXPropSet->setPropertyValue( "TextFitToSize", aAny );
                         }
-                        aCursorText->setString( aStr );
+                        aCursorText->setString(rString);
                         aXTextCursor->gotoEnd( true );
                         ImplSetTextBundle( aCursorPropSet );
                     }
diff --git a/filter/source/graphicfilter/icgm/class4.cxx b/filter/source/graphicfilter/icgm/class4.cxx
index 0185f699014c..17a12de018ce 100644
--- a/filter/source/graphicfilter/icgm/class4.cxx
+++ b/filter/source/graphicfilter/icgm/class4.cxx
@@ -185,15 +185,14 @@ void CGM::ImplDoClass4()
                 sal_uInt32 nType = ImplGetUI16();
                 sal_uInt32 nSize = ImplGetUI( 1 );
 
-                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
+                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
                     throw css::uno::Exception("attempt to read past end of input", nullptr);
 
-                mpSource[mnParaSize + nSize] = 0;
+                OUString aStr(reinterpret_cast<char*>(mpSource) + mnParaSize, nSize, RTL_TEXTENCODING_ASCII_US);
 
                 awt::Size aSize;
                 awt::Point aPoint( (long)aFloatPoint.X, (long)aFloatPoint.Y );
-                mpOutAct->DrawText( aPoint, aSize,
-                                reinterpret_cast<char*>(mpSource) + mnParaSize, (FinalFlag)nType );
+                mpOutAct->DrawText(aPoint, aSize, aStr, (FinalFlag)nType);
                 mnParaSize = mnElementSize;
             }
             break;
@@ -223,15 +222,14 @@ void CGM::ImplDoClass4()
                 sal_uInt32 nType = ImplGetUI16();
                 sal_uInt32 nSize = ImplGetUI(1);
 
-                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
+                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
                     throw css::uno::Exception("attempt to read past end of input", nullptr);
 
-                mpSource[ mnParaSize + nSize ] = 0;
+                OUString aStr(reinterpret_cast<char*>(mpSource) + mnParaSize, nSize, RTL_TEXTENCODING_ASCII_US);
 
                 awt::Point aPoint( (long)aFloatPoint.X, (long)aFloatPoint.Y );
                 awt::Size aSize((long)dx, (long)dy);
-                mpOutAct->DrawText( aPoint, aSize ,
-                                reinterpret_cast<char*>(mpSource) + mnParaSize, (FinalFlag)nType );
+                mpOutAct->DrawText(aPoint, aSize , aStr, (FinalFlag)nType);
                 mnParaSize = mnElementSize;
             }
             break;
diff --git a/filter/source/graphicfilter/icgm/outact.hxx b/filter/source/graphicfilter/icgm/outact.hxx
index 98f02a6e124f..b05ee8afd558 100644
--- a/filter/source/graphicfilter/icgm/outact.hxx
+++ b/filter/source/graphicfilter/icgm/outact.hxx
@@ -89,7 +89,7 @@ public:
     void                        DrawPolyLine( tools::Polygon& );
     void                        DrawPolybezier( tools::Polygon& );
     void                        DrawPolyPolygon( tools::PolyPolygon const & );
-    void                        DrawText( css::awt::Point const & TextRectPos, css::awt::Size const & TextRectSize, char const * String, FinalFlag );
+    void                        DrawText(css::awt::Point const & TextRectPos, css::awt::Size const & TextRectSize, const OUString& rString, FinalFlag);
     void                        AppendText( const char* String );
 
     void                        FirstOutPut() { mpCGM->mbFirstOutPut = false; } ;