diff options
author | Michael Stahl <mstahl@redhat.com> | 2013-02-15 16:27:34 +0100 |
---|---|---|
committer | Petr Mladek <pmladek@suse.cz> | 2013-02-19 09:00:51 +0000 |
commit | 47211c07ebb9e56caeb57e4d879da6e67a1119df (patch) | |
tree | e85063c4155de313225fdb6c2ac4f550e9d1402d /sw | |
parent | 6b08fe833186a04f9aef698a540d3a7493ac4519 (diff) |
fdo#60732: check max size in SwTxtNode::ReplaceTextOnly
Change-Id: I1ca2075ab99fe1b09df700f55645b44f38cf5bcc
(cherry picked from commit 0e49d87d92a3f1aeeeda547f1a7e710dcd4fee95)
Reviewed-on: https://gerrit.libreoffice.org/2182
Reviewed-by: Petr Mladek <pmladek@suse.cz>
Tested-by: Petr Mladek <pmladek@suse.cz>
Diffstat (limited to 'sw')
-rw-r--r-- | sw/source/core/txtnode/txtedt.cxx | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/sw/source/core/txtnode/txtedt.cxx b/sw/source/core/txtnode/txtedt.cxx index a5387016da69..0cdacdbb286b 100644 --- a/sw/source/core/txtnode/txtedt.cxx +++ b/sw/source/core/txtnode/txtedt.cxx @@ -1787,9 +1787,19 @@ void SwTxtNode::TransliterateText( { // now apply the changes from end to start to leave the offsets of the // yet unchanged text parts remain the same. + size_t nSum(m_Text.Len()); for (size_t i = 0; i < aChanges.size(); ++i) - { - swTransliterationChgData &rData = aChanges[ aChanges.size() - 1 - i ]; + { // check this here since AddChanges cannot be moved below + // call to ReplaceTextOnly + swTransliterationChgData & rData = + aChanges[ aChanges.size() - 1 - i ]; + nSum = nSum + rData.sChanged.Len() - rData.nLen; + if (nSum > TXTNODE_MAX) + { + SAL_WARN("sw.core", "SwTxtNode::ReplaceTextOnly: " + "node text with insertion > TXTNODE_MAX."); + return; + } if (pUndo) pUndo->AddChanges( *this, rData.nStart, rData.nLen, rData.aOffsets ); ReplaceTextOnly( rData.nStart, rData.nLen, rData.sChanged, rData.aOffsets ); @@ -1802,6 +1812,9 @@ void SwTxtNode::ReplaceTextOnly( xub_StrLen nPos, xub_StrLen nLen, const XubString& rText, const Sequence<sal_Int32>& rOffsets ) { + assert(static_cast<size_t>(m_Text.Len()) + + static_cast<size_t>(rText.Len()) - nLen <= TXTNODE_MAX); + m_Text.Replace( nPos, nLen, rText ); xub_StrLen nTLen = rText.Len(); |