sc/source/filter/excel/xiescher.cxx | 9 +++-
svtools/source/filter/wmf/winwmf.cxx | 67 +++++++++++++++++++++++++++++++----
2 files changed, 68 insertions(+), 8 deletions(-)
New commits:
commit 8b13020205c2739e7bfcff9c2324184d26d78f91
Author: Caolán McNamara <caol...@redhat.com>
Date: Thu Aug 9 09:59:38 2012 +0100
ensure placeholder substitution on XclImpDrawObjBase::ReadObj8 failure
Change-Id: I7a72153d971aaccea937955acc77cdba128985d7
Signed-off-by: Michael Stahl <mst...@redhat.com>
diff --git a/sc/source/filter/excel/xiescher.cxx
b/sc/source/filter/excel/xiescher.cxx
index 74ed03b..900d2e6 100644
--- a/sc/source/filter/excel/xiescher.cxx
+++ b/sc/source/filter/excel/xiescher.cxx
@@ -336,7 +336,7 @@ XclImpDrawObjRef XclImpDrawObjBase::ReadObj8( const
XclImpRoot& rRoot, XclImpStr
if( rStrm.GetRecLeft() >= 10 )
{
- sal_uInt16 nSubRecId, nSubRecSize, nObjType;
+ sal_uInt16 nSubRecId(0), nSubRecSize(0), nObjType(0);
rStrm >> nSubRecId >> nSubRecSize >> nObjType;
OSL_ENSURE( nSubRecId == EXC_ID_OBJCMO, "XclImpDrawObjBase::ReadObj8 -
OBJCMO subrecord expected" );
if( (nSubRecId == EXC_ID_OBJCMO) && (nSubRecSize >= 6) )
@@ -379,11 +379,16 @@ XclImpDrawObjRef XclImpDrawObjBase::ReadObj8( const
XclImpRoot& rRoot, XclImpStr
default:
OSL_TRACE( "XclImpDrawObjBase::ReadObj8 - unknown object
type 0x%04hX", nObjType );
rRoot.GetTracer().TraceUnsupportedObjects();
- xDrawObj.reset( new XclImpPhObj( rRoot ) );
}
}
}
+ if (!xDrawObj) //ensure placeholder for unknown or broken records
+ {
+ SAL_WARN( "sc", "XclImpDrawObjBase::ReadObj8 import failed,
substituting placeholder");
+ xDrawObj.reset( new XclImpPhObj( rRoot ) );
+ }
+
xDrawObj->mnTab = rRoot.GetCurrScTab();
xDrawObj->ImplReadObj8( rStrm );
return xDrawObj;
commit b1420b1c50af6b75dd0b2da18ce77af6b180496d
Author: Caolán McNamara <caol...@redhat.com>
Date: Wed Aug 8 21:39:50 2012 +0100
validate polypolygon point counts
Change-Id: Ibf6bdf48e5855583f14cd2be36f1e4896a396d32
Signed-off-by: Michael Stahl <mst...@redhat.com>
diff --git a/svtools/source/filter/wmf/winwmf.cxx
b/svtools/source/filter/wmf/winwmf.cxx
index d9daf2a..a568e3f 100644
--- a/svtools/source/filter/wmf/winwmf.cxx
+++ b/svtools/source/filter/wmf/winwmf.cxx
@@ -28,6 +28,7 @@
#include "winmtf.hxx"
+#include <boost/scoped_array.hpp>
#include <vcl/gdimtf.hxx>
#include <svtools/wmf.hxx>
#include <rtl/crc.h>
@@ -354,28 +355,55 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
case W_META_POLYPOLYGON:
{
+ bool bRecordOk = true;
sal_uInt16 nPoly = 0;
Point* pPtAry;
// Number of polygons:
*pWMF >> nPoly;
// Number of points of each polygon. Determine total number of
points
- sal_uInt16* pnPoints = new sal_uInt16[ nPoly ];
+ boost::scoped_array<sal_uInt16> xPolygonPointCounts(new
sal_uInt16[nPoly]);
+ sal_uInt16* pnPoints = xPolygonPointCounts.get();
sal_uInt16 nPoints = 0;
for(sal_uInt16 i = 0; i < nPoly; i++ )
{
*pWMF >> pnPoints[i];
+
+ if (pnPoints[i] > SAL_MAX_UINT16 - nPoints)
+ {
+ bRecordOk = false;
+ break;
+ }
+
nPoints += pnPoints[i];
}
+
+ SAL_WARN_IF(!bRecordOk, "svtools", "polypolygon record has more
polygons that we can handle");
+
+ bRecordOk &= pWMF->good();
+
+ if (!bRecordOk)
+ {
+ pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
+ break;
+ }
+
// Polygon points are:
- pPtAry = new Point[nPoints];
+ boost::scoped_array<Point> xPolygonPoints(new Point[nPoints]);
+ pPtAry = xPolygonPoints.get();
for (sal_uInt16 i = 0; i < nPoints; i++ )
pPtAry[ i ] = ReadPoint();
+ bRecordOk &= pWMF->good();
+
+ if (!bRecordOk)
+ {
+ pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
+ break;
+ }
+
// Produce PolyPolygon Actions
PolyPolygon aPolyPoly( nPoly, pnPoints, pPtAry );
pOut->DrawPolyPolygon( aPolyPoly );
- delete[] pPtAry;
- delete[] pnPoints;
}
break;
@@ -1333,16 +1361,43 @@ sal_Bool WMFReader::GetPlaceableBound( Rectangle&
rPlaceableBound, SvStream* pSt
case W_META_POLYPOLYGON:
{
+ bool bRecordOk = true;
sal_uInt16 nPoly, nPoints = 0;
*pStm >> nPoly;
for(sal_uInt16 i = 0; i < nPoly; i++ )
{
- sal_uInt16 nP;
+ sal_uInt16 nP = 0;
*pStm >> nP;
- nPoints = nPoints + nP;
+ if (nP > SAL_MAX_UINT16 - nPoints)
+ {
+ bRecordOk = false;
+ break;
+ }
+ nPoints += nP;
}
+
+ SAL_WARN_IF(!bRecordOk, "svtools", "polypolygon record has
more polygons that we can handle");
+
+ bRecordOk &= pStm->good();
+
+ if (!bRecordOk)
+ {
+ pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+ bRet = sal_False;
+ break;
+ }
+
for (sal_uInt16 i = 0; i < nPoints; i++ )
GetWinExtMax( ReadPoint(), rPlaceableBound, nMapMode );
+
+ bRecordOk &= pStm->good();
+
+ if (!bRecordOk)
+ {
+ pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+ bRet = sal_False;
+ break;
+ }
}
break;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
