1 files changed, 18 insertions, 9 deletions
diff --git a/hwpfilter/source/hwpread.cxx b/hwpfilter/source/hwpread.cxx
index 8e4a96c726d0..31be760c863a 100644
--- a/hwpfilter/source/hwpread.cxx
+++ b/hwpfilter/source/hwpread.cxx
@@ -91,10 +91,12 @@ bool FieldCode::Read(HWPFile & hwpf)
     str2.reset( new hchar[len2_ ? len2_ : 1] );
     str3.reset( new hchar[len3_ ? len3_ : 1] );
 
-    hwpf.Read2b(str1.get(), len1_);
+    if (hwpf.Read2b(str1.get(), len1_) != len1_)
+        return false;
     hwpf.SkipBlock(len1 - (len1_ * sizeof(hchar)));
     str1[len1_ ? (len1_ - 1) : 0] = 0;
-    hwpf.Read2b(str2.get(), len2_);
+    if (hwpf.Read2b(str2.get(), len2_) != len2_)
+        return false;
     hwpf.SkipBlock(len2 - (len2_ * sizeof(hchar)));
     str2[len2_ ? (len2_ - 1) : 0] = 0;
     if (hwpf.Read2b(str3.get(), len3_) != len3_)
@@ -237,7 +239,6 @@ bool TxtBox::Read(HWPFile & hwpf)
     hwpf.Read2b(&option, 1);
     hwpf.Read2b(&ctrl_ch, 1);
     hwpf.Read2b(style.margin, 12);
-    hwpf.AddFBoxStyle(&style);
     hwpf.Read2b(&box_xs, 1);
     hwpf.Read2b(&box_ys, 1);
     hwpf.Read2b(&cap_xs, 1);
@@ -366,7 +367,10 @@ bool TxtBox::Read(HWPFile & hwpf)
     else
         m_pTable = nullptr;
 
-    return !hwpf.State();
+    bSuccess = !hwpf.State();
+    if (bSuccess)
+        hwpf.AddFBoxStyle(&style);
+    return bSuccess;
 }
 
 namespace
@@ -455,6 +459,7 @@ bool Picture::Read(HWPFile & hwpf)
     scale[1] = tmp16;
 
     hwpf.ReadBlock(picinfo.picun.path, 256);      /* Picture File Name: when type is not a Drawing. */
+    picinfo.picun.path[255] = 0; // ensure null terminated
     hwpf.ReadBlock(reserved3, 9);                 /* Brightness / Contrast / Picture Effect, etc. */
 
     UpdateBBox(this);
@@ -494,7 +499,7 @@ bool Picture::Read(HWPFile & hwpf)
         if (pictype == PICTYPE_DRAW)
         {
             auto xGuard(std::make_unique<ChangeMemGuard>(follow.data(), follow_block_size));
-            LoadDrawingObjectBlock(this);
+            LoadDrawingObjectBlock(this, hwpf);
             style.cell = picinfo.picdraw.hdo;
             xGuard.reset();
         }
@@ -511,12 +516,14 @@ bool Picture::Read(HWPFile & hwpf)
         style.boxtype = 'G';
     else
         style.boxtype = 'D';
-    hwpf.AddFBoxStyle(&style);
 
 // caption
     hwpf.ReadParaList(caption);
 
-    return !hwpf.State();
+    bool bSuccess = !hwpf.State();
+    if (bSuccess)
+        hwpf.AddFBoxStyle(&style);
+    return bSuccess;
 }
 
 // line(15)
@@ -554,7 +561,6 @@ bool Line::Read(HWPFile & hwpf)
     hwpf.Read2b(&option, 1);
     hwpf.Read2b(&ctrl_ch, 1);
     hwpf.Read2b(style.margin, 12);
-    hwpf.AddFBoxStyle(&style);
     hwpf.Read2b(&box_xs, 1);
     hwpf.Read2b(&box_ys, 1);
     hwpf.Read2b(&cap_xs, 1);
@@ -583,7 +589,10 @@ bool Line::Read(HWPFile & hwpf)
     hwpf.Read2b(&color, 1);
     style.xpos = width;
 
-    return !hwpf.State();
+    bool bSuccess = !hwpf.State();
+    if (bSuccess)
+        hwpf.AddFBoxStyle(&style);
+    return bSuccess;
 }
 
 // hidden(15)