summaryrefslogtreecommitdiff
path: root/vcl/source
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2018-03-12 14:13:23 +0000
committerMichael Stahl <mstahl@redhat.com>2018-03-13 13:22:23 +0100
commit2a63eb8ba642b58814f8a78ba65a2c537aa97cdf (patch)
tree8dac95c374da8bf84e87fca8ff1c14855203e598 /vcl/source
parent216d244c6b8f4dcfe1348da05fcd6debc13bbd38 (diff)
forcepoint #27 check region bands loaded from stream for consistency
Change-Id: I92376b5fb4208c78fa25a94d4dd394256793161c Reviewed-on: https://gerrit.libreoffice.org/51145 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Michael Stahl <mstahl@redhat.com>
Diffstat (limited to 'vcl/source')
-rw-r--r--vcl/source/gdi/region.cxx8
-rw-r--r--vcl/source/gdi/regionband.cxx27
2 files changed, 30 insertions, 5 deletions
diff --git a/vcl/source/gdi/region.cxx b/vcl/source/gdi/region.cxx
index a4163402ea7a..3f52101d35c4 100644
--- a/vcl/source/gdi/region.cxx
+++ b/vcl/source/gdi/region.cxx
@@ -1586,7 +1586,7 @@ SvStream& ReadRegion(SvStream& rIStrm, vcl::Region& rRegion)
default:
{
RegionBand* pNewRegionBand = new RegionBand();
- pNewRegionBand->load(rIStrm);
+ bool bSuccess = pNewRegionBand->load(rIStrm);
rRegion.mpRegionBand.reset(pNewRegionBand);
if(aCompat.GetVersion() >= 2)
@@ -1603,6 +1603,12 @@ SvStream& ReadRegion(SvStream& rIStrm, vcl::Region& rRegion)
}
}
+ if (!bSuccess)
+ {
+ SAL_WARN("vcl.gdi", "bad region band");
+ rRegion.SetNull();
+ }
+
break;
}
}
diff --git a/vcl/source/gdi/regionband.cxx b/vcl/source/gdi/regionband.cxx
index e14029548202..22dfb5d53193 100644
--- a/vcl/source/gdi/regionband.cxx
+++ b/vcl/source/gdi/regionband.cxx
@@ -190,7 +190,7 @@ bool RegionBand::operator==( const RegionBand& rRegionBand ) const
enum StreamEntryType { STREAMENTRY_BANDHEADER, STREAMENTRY_SEPARATION, STREAMENTRY_END };
-void RegionBand::load(SvStream& rIStrm)
+bool RegionBand::load(SvStream& rIStrm)
{
// clear this instance data
implReset();
@@ -203,14 +203,14 @@ void RegionBand::load(SvStream& rIStrm)
rIStrm.ReadUInt16(nTmp16);
if (STREAMENTRY_END == (StreamEntryType)nTmp16)
- return;
+ return false;
size_t nRecordsPossible = rIStrm.remainingSize() / (2*sizeof(sal_Int32));
if (!nRecordsPossible)
{
OSL_ENSURE(false, "premature end of region stream" );
implReset();
- return;
+ return false;
}
do
@@ -259,13 +259,19 @@ void RegionBand::load(SvStream& rIStrm)
{
OSL_ENSURE(false, "premature end of region stream" );
implReset();
- return;
+ return false;
}
// get next header
rIStrm.ReadUInt16( nTmp16 );
}
while (STREAMENTRY_END != (StreamEntryType)nTmp16 && rIStrm.good());
+ if (!CheckConsistency())
+ {
+ implReset();
+ return false;
+ }
+ return true;
}
void RegionBand::save(SvStream& rOStrm) const
@@ -1155,6 +1161,19 @@ bool RegionBand::Exclude(const RegionBand& rSource)
return true;
}
+bool RegionBand::CheckConsistency() const
+{
+ // look in the band list (don't test first band again!)
+ const ImplRegionBand* pBand = mpFirstBand->mpNextBand;
+ while (pBand)
+ {
+ if (!pBand->mpFirstSep)
+ return false;
+ pBand = pBand->mpNextBand;
+ }
+ return true;
+}
+
tools::Rectangle RegionBand::GetBoundRect() const
{