diff options
author | Michael Stahl <mstahl@redhat.com> | 2014-11-22 00:21:19 +0100 |
---|---|---|
committer | Andras Timar <andras.timar@collabora.com> | 2014-12-13 16:00:39 +0100 |
commit | d5723dd309e29c704c8a2cebae64c8a9b1d2c38c (patch) | |
tree | dc91f053efa3b31d7769cb220dd8e0c3d7a1b9b0 /svx | |
parent | e998ffbe31af145ca20de07dcff8ff61fd77dafa (diff) |
svx: punish evil-doers who put duplicate properties into custom shapes
LO 4.3.2.2 is evidently able to export an ODF document that violates
XML Well-formedness constraint: Unique Att Spec.
<draw:enhanced-geometry
draw:mirror-horizontal="false"
draw:mirror-vertical="false"
svg:viewBox="0 0 21679 2134682997"
draw:text-areas="0 0 ?f3 ?f2"
draw:mirror-vertical="true"
draw:type="ooxml-rect"
draw:enhanced-path="M 0 0 L ?f3 0 ?f3 ?f2 0 ?f2 Z N">
Not sure how to reproduce this, but the attributes there are apparently a
serialization of SdrCustomShapeGeometryItem's aPropSeq,
retrieved from a "CustomShapeGeometry" property, so add some input
validation and assertions there.
(cherry picked from commit 7fcbb29db802acd8c0f32e8ff578ef4b2f82c46b)
Backport adapted to remove C++11 lambdas.
Change-Id: I91151365b507779a4bdc9cce2057d34f2376f005
Reviewed-on: https://gerrit.libreoffice.org/13111
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'svx')
-rw-r--r-- | svx/source/items/customshapeitem.cxx | 42 |
1 files changed, 41 insertions, 1 deletions
diff --git a/svx/source/items/customshapeitem.cxx b/svx/source/items/customshapeitem.cxx index 25bea99cf298..fe7942e20246 100644 --- a/svx/source/items/customshapeitem.cxx +++ b/svx/source/items/customshapeitem.cxx @@ -46,7 +46,14 @@ SdrCustomShapeGeometryItem::SdrCustomShapeGeometryItem( const uno::Sequence< bea for ( i = 0; i < aPropSeq.getLength(); i++ ) { beans::PropertyValue& rPropVal = aPropSeq[ i ]; - aPropHashMap[ rPropVal.Name ] = i; + std::pair<PropertyHashMap::iterator, bool> const ret( + aPropHashMap.insert(std::make_pair(rPropVal.Name, i))); + assert(ret.second); // serious bug: duplicate xml attribute exported + if (!ret.second) + { + throw uno::RuntimeException( + "CustomShapeGeometry has duplicate property " + rPropVal.Name, 0); + } if ( rPropVal.Value.getValueType() == ::getCppuType((const ::com::sun::star::uno::Sequence < beans::PropertyValue >*)0) ) { uno::Sequence< beans::PropertyValue >& rPropSeq = *( uno::Sequence< beans::PropertyValue >*)rPropVal.Value.getValue(); @@ -88,6 +95,19 @@ com::sun::star::uno::Any* SdrCustomShapeGeometryItem::GetPropertyValueByName( co return pRet; } +struct FindByName +{ + beans::PropertyValue const& m_rPropertyValue; + FindByName(beans::PropertyValue const& rPropertyValue) + : m_rPropertyValue(rPropertyValue) + { + } + bool operator()(beans::PropertyValue const& rVal) + { + return rVal.Name == m_rPropertyValue.Name; + } +}; + void SdrCustomShapeGeometryItem::SetPropertyValue( const com::sun::star::beans::PropertyValue& rPropVal ) { com::sun::star::uno::Any* pAny = GetPropertyValueByName( rPropVal.Name ); @@ -119,6 +139,8 @@ void SdrCustomShapeGeometryItem::SetPropertyValue( const com::sun::star::beans:: } else { // it's a new property + assert(aPropSeq.end() == std::find_if(aPropSeq.begin(), aPropSeq.end(), + FindByName(rPropVal))); sal_uInt32 nIndex = aPropSeq.getLength(); aPropSeq.realloc( nIndex + 1 ); aPropSeq[ nIndex ] = rPropVal ; @@ -142,6 +164,8 @@ void SdrCustomShapeGeometryItem::SetPropertyValue( const OUString& rSequenceName aValue.Name = rSequenceName; aValue.Value = ::com::sun::star::uno::makeAny( aSeq ); + assert(aPropSeq.end() == std::find_if(aPropSeq.begin(), aPropSeq.end(), + FindByName(aValue))); sal_uInt32 nIndex = aPropSeq.getLength(); aPropSeq.realloc( nIndex + 1 ); aPropSeq[ nIndex ] = aValue; @@ -284,7 +308,23 @@ bool SdrCustomShapeGeometryItem::PutValue( const uno::Any& rVal, sal_uInt8 /*nMe if ( ! ( rVal >>= aPropSeq ) ) return false; else + { + for (sal_Int32 i = 0; i < aPropSeq.getLength(); ++i) + { + for (sal_Int32 j = i+1; j < aPropSeq.getLength(); ++j) + { + if (aPropSeq[i].Name == aPropSeq[j].Name) + { + assert(0); // serious bug: duplicate xml attribute exported + OUString const name(aPropSeq[i].Name); + aPropSeq.realloc(0); + throw uno::RuntimeException( + "CustomShapeGeometry has duplicate property " + name, 0); + } + } + } return true; + } } const uno::Sequence< beans::PropertyValue >& SdrCustomShapeGeometryItem::GetGeometry() const { |