diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-03-10 10:21:41 +0000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-03-16 14:43:53 +0100 |
| commit | 04a5606b6ea5da5747bc97095cf6a1c91a28caf4 (patch) | |
| tree | 8555777bb71097fa3e9ee414cc14166ea215d72f /lotuswordpro | |
| parent | 9d56e2580f32411c6e13ee8f1f6a0ded3123a54b (diff) | |
ofz#801 avoid oom
Change-Id: Id3167d1eb3f058543ab7596008012d51b3d242b7
(cherry picked from commit 1353ebe535732022aef4377030d86ad7153c3144)
Reviewed-on: https://gerrit.libreoffice.org/35036
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
(cherry picked from commit 7dc65a1e0ff3059bc1f7ab77c302930e61f72831)
Diffstat (limited to 'lotuswordpro')
| -rw-r--r-- | lotuswordpro/source/filter/lwpgrfobj.cxx | 8 | ||||
| -rw-r--r-- | lotuswordpro/source/filter/lwpobjstrm.cxx | 6 | ||||
| -rw-r--r-- | lotuswordpro/source/filter/lwpobjstrm.hxx | 1 |
3 files changed, 15 insertions, 0 deletions
diff --git a/lotuswordpro/source/filter/lwpgrfobj.cxx b/lotuswordpro/source/filter/lwpgrfobj.cxx index 882f7d2b31e1..c3dc6450f7b0 100644 --- a/lotuswordpro/source/filter/lwpgrfobj.cxx +++ b/lotuswordpro/source/filter/lwpgrfobj.cxx @@ -113,6 +113,14 @@ void LwpGraphicObject::Read() unsigned char *pServerContext = nullptr; if (nServerContextSize > 0) { + sal_uInt16 nMaxPossibleSize = m_pObjStrm->remainingSize(); + + if (nServerContextSize > nMaxPossibleSize) + { + SAL_WARN("lwp", "stream too short for claimed no of records"); + nServerContextSize = nMaxPossibleSize; + } + pServerContext = new unsigned char[nServerContextSize]; m_pObjStrm->QuickRead(pServerContext, static_cast<sal_uInt16>(nServerContextSize)); if (nServerContextSize > 44) diff --git a/lotuswordpro/source/filter/lwpobjstrm.cxx b/lotuswordpro/source/filter/lwpobjstrm.cxx index c9350d8705db..bc968a550f43 100644 --- a/lotuswordpro/source/filter/lwpobjstrm.cxx +++ b/lotuswordpro/source/filter/lwpobjstrm.cxx @@ -156,6 +156,12 @@ void LwpObjectStream::ReleaseBuffer() } } } + +sal_uInt16 LwpObjectStream::remainingSize() const +{ + return m_nBufSize - m_nReadPos; +} + /** * @descr read len bytes from object stream to buffer */ diff --git a/lotuswordpro/source/filter/lwpobjstrm.hxx b/lotuswordpro/source/filter/lwpobjstrm.hxx index 918659da82b4..83062eebd0e8 100644 --- a/lotuswordpro/source/filter/lwpobjstrm.hxx +++ b/lotuswordpro/source/filter/lwpobjstrm.hxx @@ -85,6 +85,7 @@ private: LwpSvStream* m_pStrm; bool m_bCompressed; public: + sal_uInt16 remainingSize() const; sal_uInt16 QuickRead(void* buf, sal_uInt16 len); sal_uInt16 GetPos() { return m_nReadPos; } void SeekRel(sal_uInt16 pos); |