src/docrecord.py | 46 ++++++++++++++++++++++++++++--------------
test/doc/pass/kde140633-1.doc |binary
2 files changed, 31 insertions(+), 15 deletions(-)
New commits:
commit d818585de1b1e069a2f4184e983cf91aa947383e
Author: Miklos Vajna <vmik...@collabora.co.uk>
Date: Fri Oct 4 15:29:04 2013 +0200
kde#140633 fix crash on truncated Dop97 structure
The length is just enough for DopBase, don't try to read the rest of
Dop95 and Dop97.
diff --git a/src/docrecord.py b/src/docrecord.py
index 3e23071..58625e6 100644
--- a/src/docrecord.py
+++ b/src/docrecord.py
@@ -1990,15 +1990,21 @@ class Copts(DOCDirStream):
class Dop95(DOCDirStream):
"""The Dop95 structure contains document and compatibility settings."""
size = 88
- def __init__(self, dop):
+ def __init__(self, dop, dopSize):
DOCDirStream.__init__(self, dop.bytes)
self.pos = dop.pos
self.dop = dop
+ self.dopSize = dopSize
def dump(self):
print '<dop95 type="Dop95" offset="%d" size="88 bytes">' % self.pos
+ pos = self.pos
dopBase = DopBase(self)
dopBase.dump()
+ if self.pos >= pos + self.dopSize:
+ print '</dop95>'
+ self.dop.pos = self.pos
+ return
Copts80(self).dump()
self.pos += 4
print '</dop95>'
@@ -2087,15 +2093,21 @@ class Asumyi(DOCDirStream):
class Dop97(DOCDirStream):
"""The Dop97 structure contains document and compatibility settings."""
size = 500
- def __init__(self, dop):
+ def __init__(self, dop, dopSize):
DOCDirStream.__init__(self, dop.bytes)
self.pos = dop.pos
self.dop = dop
+ self.dopSize = dopSize
def dump(self):
print '<dop97 type="Dop97" offset="%d" size="%d bytes">' % (self.pos,
Dop97.size)
- dop95 = Dop95(self)
+ pos = self.pos
+ dop95 = Dop95(self, self.dopSize)
dop95.dump()
+ if self.pos >= pos + self.dopSize:
+ print '</dop97>'
+ self.dop.pos = self.pos
+ return
self.printAndSet("adt", self.readuInt16())
dopTypography = DopTypography(self)
@@ -2158,14 +2170,15 @@ class Dop97(DOCDirStream):
class Dop2000(DOCDirStream):
"""The Dop2000 structure contains document and compatibility settings."""
size = 544
- def __init__(self, dop):
+ def __init__(self, dop, dopSize):
DOCDirStream.__init__(self, dop.bytes)
self.pos = dop.pos
self.dop = dop
+ self.dopSize = dopSize
def dump(self):
print '<dop2000 type="Dop2000" offset="%d" size="544 bytes">' %
self.pos
- dop97 = Dop97(self)
+ dop97 = Dop97(self, self.dopSize)
dop97.dump()
if self.pos == self.size:
@@ -2231,14 +2244,15 @@ class Dop2000(DOCDirStream):
class Dop2002(DOCDirStream):
"""The Dop2002 structure contains document and compatibility settings."""
size = 594
- def __init__(self, dop):
+ def __init__(self, dop, dopSize):
DOCDirStream.__init__(self, dop.bytes)
self.pos = dop.pos
self.dop = dop
+ self.dopSize = dopSize
def dump(self):
print '<dop2002 type="Dop2002" offset="%d" size="%d bytes">' %
(self.pos, Dop2002.size)
- dop2000 = Dop2000(self)
+ dop2000 = Dop2000(self, self.dopSize)
dop2000.dump()
self.printAndSet("unused", self.readuInt32())
@@ -2281,14 +2295,15 @@ class Dop2002(DOCDirStream):
class Dop2003(DOCDirStream):
"""The Dop2003 structure contains document and compatibility settings."""
size = 616
- def __init__(self, dop):
+ def __init__(self, dop, dopSize):
DOCDirStream.__init__(self, dop.bytes)
self.pos = dop.pos
self.dop = dop
+ self.dopSize = dopSize
def dump(self):
print '<dop2003 type="Dop2003" offset="%d" size="616 bytes">' %
self.pos
- dop2002 = Dop2002(self)
+ dop2002 = Dop2002(self, self.dopSize)
dop2002.dump()
buf = self.readuInt8()
@@ -2361,14 +2376,15 @@ class DopMth(DOCDirStream):
class Dop2007(DOCDirStream):
"""The Dop2007 structure contains document and compatibility settings."""
- def __init__(self, dop):
+ def __init__(self, dop, dopSize):
DOCDirStream.__init__(self, dop.bytes)
self.pos = dop.pos
self.dop = dop
+ self.dopSize = dopSize
def dump(self):
print '<dop2007 type="Dop2007" offset="%d">' % self.pos
- dop2003 = Dop2003(self)
+ dop2003 = Dop2003(self, self.dopSize)
dop2003.dump()
self.printAndSet("reserved1", self.readuInt32())
@@ -2423,13 +2439,13 @@ class Dop(DOCDirStream):
def dump(self):
print '<dop type="Dop" offset="%s" size="%d bytes">' % (self.pos,
self.size)
if self.fib.nFibNew == 0:
- Dop97(self).dump()
+ Dop97(self, self.size).dump()
elif self.fib.nFibNew == 0x00d9:
- Dop2000(self).dump()
+ Dop2000(self, self.size).dump()
elif self.fib.nFibNew == 0x0101:
- Dop2002(self).dump()
+ Dop2002(self, self.size).dump()
elif self.fib.nFibNew == 0x0112:
- Dop2007(self).dump()
+ Dop2007(self, self.size).dump()
else:
print """<todo what="Dop.dump() doesn't know how to handle nFibNew
= %s"/>""" % hex(self.fib.nFibNew)
print '</dop>'
diff --git a/test/doc/pass/kde140633-1.doc b/test/doc/pass/kde140633-1.doc
new file mode 100644
index 0000000..d00bd40
Binary files /dev/null and b/test/doc/pass/kde140633-1.doc differ
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
