diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-01-25 09:21:25 +0000 |
|---|---|---|
| committer | David Tardon <dtardon@redhat.com> | 2017-01-25 13:55:18 +0000 |
| commit | 6ed838bfd59ae4db7822daf60ef12cb023799a75 (patch) | |
| tree | 3b378e3e6adc40bd76487bbbd1b40b169afe9105 /vcl | |
| parent | a235ea7a376959a462a285a2ad3cb7b74afe532f (diff) | |
ofz#463 unable to mmap
Reviewed-on: https://gerrit.libreoffice.org/33519
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit f6c465bc8e7583a8321f5c881cb008b980e0e3fa)
Change-Id: I509faeda019f42bbe7cdc5fc249f2ea2076bb702
Reviewed-on: https://gerrit.libreoffice.org/33521
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: David Tardon <dtardon@redhat.com>
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/gdi/metaact.cxx | 2 | ||||
| -rw-r--r-- | vcl/source/gdi/svmconverter.cxx | 9 |
2 files changed, 10 insertions, 1 deletions
diff --git a/vcl/source/gdi/metaact.cxx b/vcl/source/gdi/metaact.cxx index 047a207381d8..b8169cdb2553 100644 --- a/vcl/source/gdi/metaact.cxx +++ b/vcl/source/gdi/metaact.cxx @@ -1114,7 +1114,7 @@ MetaTextArrayAction::MetaTextArrayAction( const Point& rStartPt, { const sal_Int32 nAryLen = pDXAry ? mnLen : 0; - if( nAryLen ) + if (nAryLen > 0) { mpDXAry = new long[ nAryLen ]; memcpy( mpDXAry, pDXAry, nAryLen * sizeof(long) ); diff --git a/vcl/source/gdi/svmconverter.cxx b/vcl/source/gdi/svmconverter.cxx index 616e5e79918e..d9aae46824f0 100644 --- a/vcl/source/gdi/svmconverter.cxx +++ b/vcl/source/gdi/svmconverter.cxx @@ -909,6 +909,15 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf ) sal_Int32 nDXAryLen = 0; if (nAryLen > 0) { + const size_t nMinRecordSize = sizeof(sal_Int32); + const size_t nMaxRecords = rIStm.remainingSize() / nMinRecordSize; + if (static_cast<sal_uInt32>(nAryLen) > nMaxRecords) + { + SAL_WARN("vcl.gdi", "Parsing error: " << nMaxRecords << + " max possible entries, but " << nAryLen << " claimed, truncating"); + nAryLen = nMaxRecords; + } + sal_Int32 nStrLen( aStr.getLength() ); nDXAryLen = std::max(nAryLen, nStrLen); |