filter/source/msfilter/msdffimp.cxx | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
New commits:
commit 5a6e55601f0eaae1bf9f006da3f19d1c8282e7db
Author: Caolán McNamara <caol...@redhat.com>
Date: Thu Jul 16 14:53:37 2015 +0100
Resolves: tdf#92772 missing shape bg color
regression from dcad3ac445980740b6a39761cdd1f1bd0b3e6e34
coverity#1242624 Untrusted loop bound
Change-Id: Idf52c09828c2bab767e9ff0d07b61befd6bfc64b
The original code read 8 bytes on the nElemSizeVert == 8
branch and always 4 otherwise. I assumed that nElemSizeVert had
to be read as 4 on that branch, but apparently not. So if its
not 4, set it to 4 and we get the same behaviour as originally
and continue to ensure we bounds check the loop
Change-Id: Ica8ab7cc3bbebee93216766a2e1279a579494840
(cherry picked from commit b3cd47bd562f98ec5fcff1a9d7609353506b5083)
Reviewed-on: https://gerrit.libreoffice.org/17135
Reviewed-by: David Tardon <dtar...@redhat.com>
Tested-by: David Tardon <dtar...@redhat.com>
Reviewed-by: Tomaž Vajngerl <qui...@gmail.com>
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/filter/source/msfilter/msdffimp.cxx
b/filter/source/msfilter/msdffimp.cxx
index 9e88ceb..ba0aae0 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -2154,12 +2154,10 @@ void
DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
sal_uInt16 nNumElemMemVert = 0;
rIn.ReadUInt16( nNumElemVert ).ReadUInt16( nNumElemMemVert
).ReadUInt16( nElemSizeVert );
}
- bool bImport = false;
- if (nElemSizeVert == 8 || nElemSizeVert == 4)
- {
- //sanity check that the stream is long enough to fulfill
nNumElem * nElemSize;
- bImport = rIn.remainingSize() / nElemSizeVert >= nNumElemVert;
- }
+ if (nElemSizeVert != 8)
+ nElemSizeVert = 4;
+ //sanity check that the stream is long enough to fulfill nNumElem
* nElemSize;
+ bool bImport = rIn.remainingSize() / nElemSizeVert >= nNumElemVert;
if (bImport)
{
aCoordinates.realloc( nNumElemVert );
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
