diff options
| author | Miklos Vajna <vmiklos@collabora.co.uk> | 2018-03-02 11:18:21 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2018-04-07 17:43:42 +0200 |
| commit | ff34cd64c1a6e37bcba1cad9ffd1c3c23d48bf01 (patch) | |
| tree | 227af7ac0bc5cc9dc68615322dad5ed21829eec5 /xmlsecurity | |
| parent | c51cd09e36e37226c79609899440e8d4458cb7ad (diff) | |
forcepoint #16: fix heap-use-after-free
PDFDocument::Tokenize() in the aKeyword == "obj" case allocates a
PDFObjectElement, stores it as an owning pointer inside rElements, and
also stores two non-owning references to it in m_aOffsetObjects and
m_aIDObjects. So make sure those 2 other containers are also cleared
then elements go away.
LO_TRACE="valgrind" bin/run pdfverify <sample>
doesn't report errors anymore after the fix.
Reviewed-on: https://gerrit.libreoffice.org/50632
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 506d4cbc2f0dbef6f20f1199efcda805c9901d09)
Change-Id: Ie103de3e24a1080257a79e53b994e8536a9597bc
Diffstat (limited to 'xmlsecurity')
| -rw-r--r-- | xmlsecurity/qa/unit/pdfsigning/data/forcepoint16.pdf | bin | 0 -> 51200 bytes | |||
| -rw-r--r-- | xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx | 2 |
2 files changed, 2 insertions, 0 deletions
diff --git a/xmlsecurity/qa/unit/pdfsigning/data/forcepoint16.pdf b/xmlsecurity/qa/unit/pdfsigning/data/forcepoint16.pdf Binary files differnew file mode 100644 index 000000000000..9edccb47f40c --- /dev/null +++ b/xmlsecurity/qa/unit/pdfsigning/data/forcepoint16.pdf diff --git a/xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx b/xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx index b7bca31a6caa..7be3d38e8b3b 100644 --- a/xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx +++ b/xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx @@ -416,6 +416,8 @@ void PDFSigningTest::testTokenize() // File that's intentionally smaller than 1024 bytes. OUStringLiteral("small.pdf"), OUStringLiteral("tdf107149.pdf"), + // Valgrind was unhappy about this. + OUStringLiteral("forcepoint16.pdf"), }; for (const auto& rName : aNames) |