diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-08-23 09:39:05 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-08-23 13:32:53 +0200 |
| commit | 47b8e414dd6f034a94f594c237c428c69a07f0cf (patch) | |
| tree | 691f40e0eb96f1a6cbf2a94d4610fdd1aa3bd6b0 /svtools | |
| parent | b640c566908de902c26bf209c79c7c3efa4a0def (diff) | |
ofz#10022 oom in htmlfuzzer
Change-Id: Ia33b10e0184cb97cf895a9c926a81863c281b1f4
Reviewed-on: https://gerrit.libreoffice.org/59490
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'svtools')
| -rw-r--r-- | svtools/source/svhtml/parhtml.cxx | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/svtools/source/svhtml/parhtml.cxx b/svtools/source/svhtml/parhtml.cxx index fa31a1271d95..14ed546ca9fe 100644 --- a/svtools/source/svhtml/parhtml.cxx +++ b/svtools/source/svhtml/parhtml.cxx @@ -1142,6 +1142,7 @@ HtmlTokenId HTMLParser::GetNextToken_() bool bDone = false; // Read until closing -->. If not found restart at first > + sTmpBuffer = aToken; while( !bDone && !rInput.eof() && IsParserWorking() ) { if( '>'==nNextCh ) @@ -1149,19 +1150,20 @@ HtmlTokenId HTMLParser::GetNextToken_() if( !nCStreamPos ) { nCStreamPos = rInput.Tell(); - nCStrLen = aToken.getLength(); + nCStrLen = sTmpBuffer.getLength(); nCLineNr = GetLineNr(); nCLinePos = GetLinePos(); } - bDone = aToken.endsWith( "--" ); + bDone = sTmpBuffer.getLength() >= 2 && sTmpBuffer[sTmpBuffer.getLength() - 2] == '-' && sTmpBuffer[sTmpBuffer.getLength() - 1] == '-'; if( !bDone ) - aToken += OUString(&nNextCh,1); + sTmpBuffer.appendUtf32(nNextCh); } else - aToken += OUString(&nNextCh,1); + sTmpBuffer.appendUtf32(nNextCh); if( !bDone ) nNextCh = GetNextChar(); } + aToken = sTmpBuffer.makeStringAndClear(); if( !bDone && IsParserWorking() && nCStreamPos ) { rInput.Seek( nCStreamPos ); |