ofz#3201: avoid oom

Change-Id: Ia8e171a003f24c73c7f53ca7240e03c6f2492ad3
Reviewed-on: https://gerrit.libreoffice.org/41670
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

4 files changed, 22 insertions, 20 deletions

diff --git a/hwpfilter/source/htags.cxx b/hwpfilter/source/htags.cxx
index ddd9438e0358..6bccf5c85bbc 100644
--- a/hwpfilter/source/htags.cxx
+++ b/hwpfilter/source/htags.cxx
@@ -25,13 +25,13 @@
 #include "hwpfile.h"
 #include "htags.h"
 
-void HyperText::Read(HWPFile & hwpf)
+bool HyperText::Read(HWPFile& hwpf)
 {
-    hwpf.Read1b(filename, 256);
-    hwpf.Read2b(bookmark, 16);
-    hwpf.Read1b(macro, 325);
-    hwpf.Read1b(&type, 1);
-    hwpf.Read1b(reserve, 3);
+    size_t nRead = hwpf.Read1b(filename, 256);
+    nRead += hwpf.Read2b(bookmark, 16);
+    nRead += hwpf.Read1b(macro, 325);
+    nRead += hwpf.Read1b(&type, 1);
+    nRead += hwpf.Read1b(reserve, 3);
     if( type == 2 )
     {
         for( int i = 1; i < 256; i++)
@@ -41,9 +41,9 @@ void HyperText::Read(HWPFile & hwpf)
                 break;
         }
     }
+    return nRead == 617;
 }
 
-
 EmPicture::EmPicture(size_t tsize)
     : size(tsize >= 32 ? tsize - 32 : 0)
 {
diff --git a/hwpfilter/source/htags.h b/hwpfilter/source/htags.h
index 5d044ee8666e..e306373c6812 100644
--- a/hwpfilter/source/htags.h
+++ b/hwpfilter/source/htags.h
@@ -48,7 +48,7 @@ struct HyperText
     char  macro[325];
     uchar type;
     char reserve[3];
-    void Read(HWPFile& hwpf);
+    bool Read(HWPFile& hwpf);
 };
 /**
  * @short Win32 OLE object
diff --git a/hwpfilter/source/hwpfile.cxx b/hwpfilter/source/hwpfile.cxx
index 43fad53c3829..a693f15d3d55 100644
--- a/hwpfilter/source/hwpfile.cxx
+++ b/hwpfilter/source/hwpfile.cxx
@@ -174,32 +174,27 @@ size_t HWPFile::Read1b(void *ptr, size_t nmemb)
     return hiodev ? hiodev->read1b(ptr, nmemb) : 0;
 }
 
-void HWPFile::Read2b(void *ptr, size_t nmemb)
+size_t HWPFile::Read2b(void *ptr, size_t nmemb)
 {
-    if (hiodev)
-        hiodev->read2b(ptr, nmemb);
+    return hiodev ? hiodev->read2b(ptr, nmemb) : 0;
 }
 
-
 void HWPFile::Read4b(void *ptr, size_t nmemb)
 {
     if (hiodev)
         hiodev->read4b(ptr, nmemb);
 }
 
-
 size_t HWPFile::ReadBlock(void *ptr, size_t size)
 {
     return hiodev ? hiodev->readBlock(ptr, size) : 0;
 }
 
-
 size_t HWPFile::SkipBlock(size_t size)
 {
     return hiodev ? hiodev->skipBlock(size) : 0;
 }
 
-
 void HWPFile::SetCompressed(bool flag)
 {
     if (hiodev)
@@ -313,15 +308,22 @@ void HWPFile::TagsRead()
                 break;
             case FILETAG_HYPERTEXT:
             {
-                if( (size % 617) != 0 )
+                const int nRecordLen = 617;
+                if( (size % nRecordLen) != 0 )
                     SkipBlock( size );
                 else
                 {
-                    for( int i = 0 ; i < size/617 ; i++)
+                    const int nRecords = size / nRecordLen;
+                    for (int i = 0 ; i < nRecords; ++i)
                     {
                         HyperText *hypert = new HyperText;
-                        hypert->Read(*this);
-                        hyperlist.push_back(hypert);
+                        if (hypert->Read(*this))
+                            hyperlist.push_back(hypert);
+                        else
+                        {
+                            delete hypert;
+                            break;
+                        }
                     }
                 }
                 break;
diff --git a/hwpfilter/source/hwpfile.h b/hwpfilter/source/hwpfile.h
index 9b002e8abbee..79474c665fb6 100644
--- a/hwpfilter/source/hwpfile.h
+++ b/hwpfilter/source/hwpfile.h
@@ -143,7 +143,7 @@ class DLLEXPORT HWPFile
 /**
  * Reads nmemb short type array from HIODev
  */
-        void Read2b( void *ptr, size_t nmemb );
+        size_t Read2b(void *ptr, size_t nmemb);
 /**
  * Reads nmemb long type array from HIODev
  */