vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-2.emf |binary
vcl/source/filter/wmf/enhwmf.cxx | 33 +++++++----------
2 files changed, 15 insertions(+), 18 deletions(-)
New commits:
commit fdc60b7497439e25a1b30d259f3407aeff8e3236
Author: Caolán McNamara <caol...@redhat.com>
Date: Fri Aug 14 09:25:32 2015 +0100
limit access to dx array to min of input len and len of array
i.e. the sal_Int32 nDXLen = std::min<sal_Int32>(nLen, aOldDX.size()); line
and its usage
Change-Id: Ib0100d2de210a45b340c3a7de6c6dcf2a07443d0
(cherry picked from commit 6d4f97b05b1bfe5aae395134b2dc35805c23b8c4)
Reviewed-on: https://gerrit.libreoffice.org/17751
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Norbert Thiebaud <nthieb...@gmail.com>
diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-2.emf
b/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-2.emf
new file mode 100644
index 0000000..a522132
Binary files /dev/null and
b/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-2.emf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index 8b92f54..7f7bf81 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -1425,7 +1425,7 @@ bool EnhWMFReader::ReadEnhWMF()
sal_Int32 nLeft, nTop, nRight, nBottom, ptlReferenceX,
ptlReferenceY, nGfxMode, nXScale, nYScale;
sal_uInt32 nCurPos, nOffString, nOptions, offDx;
sal_Int32 nLen;
- long* pDX = NULL;
+ std::vector<long> aDX;
nCurPos = pWMF->Tell() - 8;
@@ -1451,13 +1451,12 @@ bool EnhWMFReader::ReadEnhWMF()
pWMF->Seek( nCurPos + offDx );
if ( ( nLen * sizeof(sal_uInt32) ) <= ( nEndPos -
pWMF->Tell() ) )
{
- pDX = new long[ nLen ];
- sal_Int32 i;
- sal_Int32 val;
- for ( i = 0; i < nLen; i++ )
+ aDX.resize(nLen);
+ for (sal_Int32 i = 0; i < nLen; ++i)
{
- pWMF->ReadInt32( val );
- pDX[ i ] = val;
+ sal_Int32 val(0);
+ pWMF->ReadInt32(val);
+ aDX[i] = val;
}
}
}
@@ -1469,23 +1468,22 @@ bool EnhWMFReader::ReadEnhWMF()
{
boost::scoped_array<sal_Char> pBuf(new
sal_Char[ nLen ]);
pWMF->Read( pBuf.get(), nLen );
- aText = OUString( pBuf.get(),
(sal_uInt16)nLen, pOut->GetCharSet() );
+ aText = OUString(pBuf.get(), nLen,
pOut->GetCharSet());
pBuf.reset();
if ( aText.getLength() != nLen )
{
- sal_uInt16 i, j;
- long* pOldDx = pDX;
- pDX = new long[ aText.getLength() ];
- for ( i = 0, j = 0; i < aText.getLength();
i++ )
+ std::vector<long>
aOldDX(aText.getLength());
+ aOldDX.swap(aDX);
+ sal_Int32 nDXLen =
std::min<sal_Int32>(nLen, aOldDX.size());
+ for (sal_Int32 i = 0, j = 0; i <
aText.getLength(); ++i)
{
sal_Unicode cUniChar = aText[i];
OString aCharacter(&cUniChar, 1,
pOut->GetCharSet());
- pDX[ i ] = 0;
- for (sal_Int32 k = 0; ( k <
aCharacter.getLength() ) && ( j < nLen ) && ( i < aText.getLength() ); ++k)
- pDX[ i ] += pOldDx[ j++ ];
+ aDX[i] = 0;
+ for (sal_Int32 k = 0; ( k <
aCharacter.getLength() ) && ( j < nDXLen ) && ( i < aText.getLength() ); ++k)
+ aDX[ i ] += aOldDX[j++];
}
- delete[] pOldDx;
}
}
}
@@ -1507,9 +1505,8 @@ bool EnhWMFReader::ReadEnhWMF()
aText = OUString(pBuf.get(), nLen);
}
}
- pOut->DrawText( aPos, aText, pDX, bRecordPath,
nGfxMode );
+ pOut->DrawText(aPos, aText, aDX.data(), bRecordPath,
nGfxMode);
}
- delete[] pDX;
}
break;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
