diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-01-17 21:19:13 +0000 |
|---|---|---|
| committer | Michael Stahl <mstahl@redhat.com> | 2017-01-18 12:32:56 +0000 |
| commit | a304efedd2ca20f9ad29c18c996d00aadf30cf12 (patch) | |
| tree | 73a86d6621fb17342be9707db0d23e3d2292d546 /filter | |
| parent | b35ea66a9381c4ddee52bb9aa94b51ecaff98605 (diff) | |
ofz#414 crash in DXFHatchEntity::EvaluateGroup
(cherry picked from commit 5434d51d12611eb2726ce1394eb01921d008fa89)
ofz#415 crash in DXFVector::DXFVector
(cherry picked from commit 2a9b4363ca190f1d783d540e95a031357f852858)
Change-Id: I15c8cb7aeb8c45f32357afd0ea2f550ffe11dbf7
Reviewed-on: https://gerrit.libreoffice.org/33233
Reviewed-by: Michael Stahl <mstahl@redhat.com>
Tested-by: Michael Stahl <mstahl@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/idxf/dxfentrd.cxx | 15 | ||||
| -rw-r--r-- | filter/source/graphicfilter/idxf/dxfgrprd.cxx | 4 | ||||
| -rw-r--r-- | filter/source/graphicfilter/idxf/dxfgrprd.hxx | 1 |
3 files changed, 17 insertions, 3 deletions
diff --git a/filter/source/graphicfilter/idxf/dxfentrd.cxx b/filter/source/graphicfilter/idxf/dxfentrd.cxx index 85508ac2d1cc..d4f7e30e6d08 100644 --- a/filter/source/graphicfilter/idxf/dxfentrd.cxx +++ b/filter/source/graphicfilter/idxf/dxfentrd.cxx @@ -422,8 +422,11 @@ void DXFLWPolyLineEntity::EvaluateGroup( DXFGroupReader & rDGR ) case 90 : { nCount = rDGR.GetI(); - if ( nCount ) + // limit alloc to max reasonable size based on remaining data in stream + if (nCount > 0 && static_cast<sal_uInt32>(nCount) <= rDGR.remainingSize()) pP = new DXFVector[ nCount ]; + else + nCount = 0; } break; case 70: nFlags = rDGR.GetI(); break; @@ -600,8 +603,11 @@ bool DXFBoundaryPathData::EvaluateGroup( DXFGroupReader & rDGR ) case 93 : { nPointCount = rDGR.GetI(); - if ( nPointCount ) + // limit alloc to max reasonable size based on remaining data in stream + if (nPointCount > 0 && static_cast<sal_uInt32>(nPointCount) <= rDGR.remainingSize()) pP = new DXFVector[ nPointCount ]; + else + nPointCount = 0; } break; case 72 : nHasBulgeFlag = rDGR.GetI(); break; @@ -679,8 +685,11 @@ void DXFHatchEntity::EvaluateGroup( DXFGroupReader & rDGR ) { bIsInBoundaryPathContext = true; nBoundaryPathCount = rDGR.GetI(); - if ( nBoundaryPathCount ) + // limit alloc to max reasonable size based on remaining data in stream + if (nBoundaryPathCount > 0 && static_cast<sal_uInt32>(nBoundaryPathCount) <= rDGR.remainingSize()) pBoundaryPathData = new DXFBoundaryPathData[ nBoundaryPathCount ]; + else + nBoundaryPathCount = 0; } break; case 75 : diff --git a/filter/source/graphicfilter/idxf/dxfgrprd.cxx b/filter/source/graphicfilter/idxf/dxfgrprd.cxx index caa2c4263bf2..a6c02a408c7c 100644 --- a/filter/source/graphicfilter/idxf/dxfgrprd.cxx +++ b/filter/source/graphicfilter/idxf/dxfgrprd.cxx @@ -217,5 +217,9 @@ void DXFGroupReader::ReadS() S = DXFReadLine(rIS); } +sal_uInt64 DXFGroupReader::remainingSize() const +{ + return rIS.remainingSize(); +} /* vim:set shiftwidth=4 softtabstop=4 expandtab: */ diff --git a/filter/source/graphicfilter/idxf/dxfgrprd.hxx b/filter/source/graphicfilter/idxf/dxfgrprd.hxx index c936b33b428b..09bbcd3676e4 100644 --- a/filter/source/graphicfilter/idxf/dxfgrprd.hxx +++ b/filter/source/graphicfilter/idxf/dxfgrprd.hxx @@ -59,6 +59,7 @@ public: // This read must have returned a group code for datatype String. // If not NULL is returend + sal_uInt64 remainingSize() const; private: long ReadI(); |