binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx | 4
binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx | 73 ++++++++++--
2 files changed, 68 insertions(+), 9 deletions(-)
New commits:
commit de9acff682c036f7e0f24427098a14042371b155
Author: Caolán McNamara <caol...@redhat.com>
Date: Wed Aug 15 17:02:29 2012 +0100
merge in various filter work from core
Change-Id: I14ca1319e7e96941037450aee59d7a926d290c71
diff --git a/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
b/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
index 511b1a2..5f3c5b8 100644
--- a/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
+++ b/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
@@ -44,6 +44,10 @@ GIFReader::GIFReader( SvStream& rStm ) :
nLastPos ( rStm.Tell() ),
nLogWidth100 ( 0UL ),
nLogHeight100 ( 0UL ),
+ nGlobalWidth ( 0 ),
+ nGlobalHeight ( 0 ),
+ nImageWidth ( 0 ),
+ nImageHeight ( 0 ),
nLoops ( 1 ),
eActAction ( GLOBAL_HEADER_READING ),
bGCTransparent ( FALSE ),
diff --git a/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
b/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
index d617a99..7934b87 100644
--- a/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
+++ b/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
@@ -18,6 +18,7 @@
*/
#include "winmtf.hxx"
+#include <boost/scoped_array.hpp>
#include <rtl/crc.h>
#include <rtl/tencinfo.h>
#include <osl/endian.h>
@@ -320,28 +321,54 @@ void WMFReader::ReadRecordParams( USHORT nFunc )
case W_META_POLYPOLYGON:
{
- USHORT i, nPoly, nPoints;
- USHORT* pnPoints;
+ bool bRecordOk = true;
+ USHORT i, nPoly = 0, nPoints = 0;
Point* pPtAry;
// Anzahl der Polygone:
*pWMF >> nPoly;
// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der
Punkte ermitteln:
- pnPoints = new USHORT[ nPoly ];
- nPoints = 0;
+ boost::scoped_array<USHORT> xPolygonPointCounts(new USHORT[nPoly]);
+ USHORT* pnPoints = xPolygonPointCounts.get();
for( i = 0; i < nPoly; i++ )
{
*pWMF >> pnPoints[i];
- nPoints = nPoints + pnPoints[i];
+
+ if (pnPoints[i] > SAL_MAX_UINT16 - nPoints)
+ {
+ bRecordOk = false;
+ break;
+ }
+
+ nPoints += pnPoints[i];
}
+
+ SAL_WARN_IF(!bRecordOk, "svtools", "polypolygon record has more
polygons than we can handle");
+
+ bRecordOk &= pWMF->good();
+
+ if (!bRecordOk)
+ {
+ pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
+ break;
+ }
+
// Polygonpunkte holen:
- pPtAry = (Point*) new char[ nPoints * sizeof(Point) ];
+ boost::scoped_array<Point> xPolygonPoints(new Point[nPoints]);
+ pPtAry = xPolygonPoints.get();
for ( i = 0; i < nPoints; i++ )
pPtAry[ i ] = ReadPoint();
+
+ bRecordOk &= pWMF->good();
+
+ if (!bRecordOk)
+ {
+ pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
+ break;
+ }
+
// PolyPolygon Actions erzeugen
PolyPolygon aPolyPoly( nPoly, pnPoints, pPtAry );
pOut->DrawPolyPolygon( aPolyPoly );
- delete[] (char*) pPtAry;
- delete[] pnPoints;
}
break;
@@ -1171,16 +1198,44 @@ sal_Bool WMFReader::GetPlaceableBound( Rectangle&
rPlaceableBound, SvStream* pSt
case W_META_POLYPOLYGON:
{
+ bool bRecordOk = true;
USHORT i, nPoly, nPoints = 0;
*pStm >> nPoly;
for( i = 0; i < nPoly; i++ )
{
- sal_uInt16 nP;
+ sal_uInt16 nP = 0;
*pStm >> nP;
nPoints = nPoints + nP;
+ if (nP > SAL_MAX_UINT16 - nPoints)
+ {
+ bRecordOk = false;
+ break;
+ }
+ nPoints += nP;
}
+
+ SAL_WARN_IF(!bRecordOk, "svtools", "polypolygon record has
more polygons than we can handle");
+
+ bRecordOk &= pStm->good();
+
+ if (!bRecordOk)
+ {
+ pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+ bRet = sal_False;
+ break;
+ }
+
for ( i = 0; i < nPoints; i++ )
GetWinExtMax( ReadPoint(), rPlaceableBound, nMapMode );
+
+ bRecordOk &= pStm->good();
+
+ if (!bRecordOk)
+ {
+ pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+ bRet = sal_False;
+ break;
+ }
}
break;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
