diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-03-01 14:11:47 +0000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-03-06 16:08:03 +0100 |
| commit | b86dfc828a26dfbaa0d80f56ed09c741a17b7867 (patch) | |
| tree | 1bca46049d2e89175393633aa08109e3dced921c /lotuswordpro | |
| parent | 1d4ddce58160656188c4df71bc9097097dca12f6 (diff) | |
ofz: oom on seeks past end of SvMemoryStream
cause it grows to fit if its a resizable stream
Change-Id: I28b42becdfc8eb591d19d2512cdc1f1ec32c3bbe
(cherry picked from commit a42d9c5b541d637dcf24086e30f341b30e03c4c7)
Reviewed-on: https://gerrit.libreoffice.org/34753
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit fb604dd5340ddb367f11ab53966cae1bd549863c)
Diffstat (limited to 'lotuswordpro')
| -rw-r--r-- | lotuswordpro/source/filter/lwpfilter.cxx | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/lotuswordpro/source/filter/lwpfilter.cxx b/lotuswordpro/source/filter/lwpfilter.cxx index 0389ee3cbaf9..9a3bcfcdfb5d 100644 --- a/lotuswordpro/source/filter/lwpfilter.cxx +++ b/lotuswordpro/source/filter/lwpfilter.cxx @@ -104,7 +104,7 @@ using namespace OpenStormBento; bool Decompress(SvStream *pCompressed, SvStream * & pOutDecompressed) { pCompressed->Seek(0); - std::unique_ptr<SvStream> aDecompressed(new SvMemoryStream(4096, 4096)); + std::unique_ptr<SvMemoryStream> aDecompressed(new SvMemoryStream(4096, 4096)); unsigned char buffer[512]; pCompressed->ReadBytes(buffer, 16); aDecompressed->WriteBytes(buffer, 16); @@ -132,6 +132,9 @@ using namespace OpenStormBento; while (sal_uInt32 iRead = pCompressed->ReadBytes(buffer, 512)) aDecompressed->WriteBytes(buffer, iRead); + // disable stream growing past its current size + aDecompressed->SetResizeOffset(0); + //transfer ownership of aDecompressed's ptr pOutDecompressed = aDecompressed.release(); return true; |