[Libreoffice-commits] core.git: Branch 'distro/cib/libreoffice-6-1' - 2 commits - hwpfilter/source lotuswordpro/source

[Michael Stahl (via logerrit)]

 hwpfilter/source/hwpread.cxx              |    1 +
 lotuswordpro/source/filter/lwpdrawobj.cxx |    6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

New commits:
commit 0c5048143054e973f5cb945ddd61d50fa1aac0ab
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Fri Mar 11 17:29:41 2022 +0100
Commit:     Michael Stahl <michael.st...@allotropia.de>
CommitDate: Fri Mar 18 15:19:24 2022 +0100

    hwpfilter: why isn't that path string null terminated
    
    Change-Id: Iaedc23bd91d0d46e34d55dcc65760b73c5772b7e
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131559
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 4c86ed851bc1c0a2414e254082064760c99437f1)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131589
    Tested-by: Caolán McNamara <caol...@redhat.com>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit dc566a7f687a728311490b5f4f624897f0aefd1d)

diff --git a/hwpfilter/source/hwpread.cxx b/hwpfilter/source/hwpread.cxx
index 1ef27f7c243f..7e0564b187a4 100644
--- a/hwpfilter/source/hwpread.cxx
+++ b/hwpfilter/source/hwpread.cxx
@@ -426,6 +426,7 @@ bool Picture::Read(HWPFile & hwpf)
     scale[1] = tmp16;
 
     hwpf.ReadBlock(picinfo.picun.path, 256);      /* Picture File Name: when 
type is not a Drawing. */
+    picinfo.picun.path[255] = 0; // ensure null terminated
     hwpf.ReadBlock(reserved3, 9);                 /* Brightness / Contrast / 
Picture Effect, etc. */
 
     UpdateBBox(this);
commit 72090be467eda13587964c25a0c125572f440a1e
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Mar 13 10:48:47 2022 +0000
Commit:     Michael Stahl <michael.st...@allotropia.de>
CommitDate: Fri Mar 18 15:19:18 2022 +0100

    ofz#45524 string is presumed to be at least length 1
    
    Change-Id: If8a86e399109b414cf53f6e2bffdd3c7c6faa490
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131468
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit eca150aeb9254a3c04d15be5a6278c2c65bf3fb0)

diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx 
b/lotuswordpro/source/filter/lwpdrawobj.cxx
index 742e38f82c24..d1e496481c3d 100644
--- a/lotuswordpro/source/filter/lwpdrawobj.cxx
+++ b/lotuswordpro/source/filter/lwpdrawobj.cxx
@@ -1255,7 +1255,11 @@ void LwpDrawTextArt::Read()
                                                     - 
(m_aTextArtRec.aPath[1].n*3 + 1)*4;
 
 
-    if (!m_pStream->good() || m_aTextArtRec.nTextLen > 
m_pStream->remainingSize())
+    if (!m_pStream->good())
+        throw BadRead();
+    if (m_aTextArtRec.nTextLen > m_pStream->remainingSize())
+        throw BadRead();
+    if (m_aTextArtRec.nTextLen < 1)
         throw BadRead();
 
     m_aTextArtRec.pTextString = new sal_uInt8 [m_aTextArtRec.nTextLen];