ofz: reduce scope, check stream, validate nActions

(cherry picked from commit bd78b28a1233e26c023a52df6b119d60a61d53ad)

Change-Id: Ie420ad40b0d852708828620cd26c2f746398f5a8
Reviewed-on: https://gerrit.libreoffice.org/33260
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>

1 files changed, 25 insertions, 10 deletions

diff --git a/vcl/source/gdi/cvtsvm.cxx b/vcl/source/gdi/cvtsvm.cxx
index 6ad9e4ad8df3..83b000a71e17 100644
--- a/vcl/source/gdi/cvtsvm.cxx
+++ b/vcl/source/gdi/cvtsvm.cxx
@@ -474,12 +474,12 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
     char    aCode[ 5 ];
     Size    aPrefSz;
-    sal_Int16   nSize;
-    sal_Int16   nVersion;
 
     // read header
     rIStm.Read( aCode, sizeof( aCode ) );  // Identifier
+    sal_Int16 nSize(0);
     rIStm.ReadInt16( nSize );                                 // Size
+    sal_Int16 nVersion(0);
     rIStm.ReadInt16( nVersion );                              // Version
     sal_Int32 nTmp32(0);
     rIStm.ReadInt32( nTmp32 );
@@ -511,24 +511,37 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
         Point       aPt, aPt1;
         Size        aSz;
         Color       aActionColor;
-        sal_Int32       nTmp, nTmp1, nActionSize;
-        sal_Int32       nActions;
-        sal_Int16       nType;
 
         sal_uInt32  nUnicodeCommentStreamPos = 0;
         sal_Int32       nUnicodeCommentActionNumber = 0;
 
         ImplReadMapMode( rIStm, aMapMode );             // MapMode
-        rIStm.ReadInt32( nActions );                              // Action count
+        sal_Int32 nActions(0);
+        rIStm.ReadInt32( nActions );                    // Action count
+        if (nActions < 0)
+        {
+            SAL_WARN("vcl.gdi", "svm claims negative action count (" << nActions << ")");
+            nActions = 0;
+        }
+
+        const size_t nMinActionSize = sizeof(sal_uInt16) + sizeof(sal_Int32);
+        const size_t nMaxPossibleActions = rIStm.remainingSize() / nMinActionSize;
+        if (static_cast<sal_uInt32>(nActions) > nMaxPossibleActions)
+        {
+            SAL_WARN("vcl.gdi", "svm claims more actions (" << nActions << ") than stream could provide, truncating");
+            nActions = nMaxPossibleActions;
+        }
 
         rMtf.SetPrefSize( aPrefSz );
         rMtf.SetPrefMapMode( aMapMode );
         size_t nLastPolygonAction(0);
 
-        for (sal_Int32 i = 0; i < nActions; ++i)
+        for (sal_Int32 i = 0; i < nActions && rIStm.good(); ++i)
         {
+            sal_Int16 nType(0);
             rIStm.ReadInt16( nType );
             sal_Int32 nActBegin = rIStm.Tell();
+            sal_Int32 nActionSize(0);
             rIStm.ReadInt32( nActionSize );
 
             DBG_ASSERT( ( nType <= 33 ) || ( nType >= 1024 ), "Unknown GDIMetaAction while converting!" );
@@ -665,6 +678,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                 case( GDI_RECT_ACTION ):
                 {
                     ImplReadRect( rIStm, aRect );
+                    sal_Int32 nTmp(0), nTmp1(0);
                     rIStm.ReadInt32( nTmp ).ReadInt32( nTmp1 );
 
                     if( nTmp || nTmp1 )
@@ -857,7 +871,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
                 case( GDI_TEXT_ACTION ):
                 {
-                    sal_Int32       nIndex, nLen;
+                    sal_Int32 nIndex(0), nLen(0), nTmp(0);
 
                     ReadPair( rIStm, aPt ).ReadInt32( nIndex ).ReadInt32( nLen ).ReadInt32( nTmp );
                     if (nTmp > 0)
@@ -878,7 +892,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
                 case( GDI_TEXTARRAY_ACTION ):
                 {
-                    sal_Int32   nIndex, nLen, nAryLen;
+                    sal_Int32 nIndex(0), nLen(0), nAryLen(0), nTmp(0);
 
                     ReadPair( rIStm, aPt ).ReadInt32( nIndex ).ReadInt32( nLen ).ReadInt32( nTmp ).ReadInt32( nAryLen );
                     if (nTmp > 0)
@@ -937,7 +951,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
                 case( GDI_STRETCHTEXT_ACTION ):
                 {
-                    sal_Int32       nIndex, nLen, nWidth;
+                    sal_Int32 nIndex(0), nLen(0), nWidth(0), nTmp(0);
 
                     ReadPair( rIStm, aPt ).ReadInt32( nIndex ).ReadInt32( nLen ).ReadInt32( nTmp ).ReadInt32( nWidth );
                     if (nTmp > 0)
@@ -1090,6 +1104,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
                 case( GDI_MOVECLIPREGION_ACTION ):
                 {
+                    sal_Int32 nTmp(0), nTmp1(0);
                     rIStm.ReadInt32( nTmp ).ReadInt32( nTmp1 );
                     rMtf.AddAction( new MetaMoveClipRegionAction( nTmp, nTmp1 ) );
                 }