diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-08-24 14:05:00 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-08-24 14:32:29 +0100 |
| commit | c0c9075163f06c0b5c2ad9cf428f1cfacf9fe1fb (patch) | |
| tree | 4036209b3d1856aa7066903ae667f2e6df063144 | |
| parent | 479862c75094bcd4d49d2cca4e29a298618e7665 (diff) | |
limit seeks to valid area
Change-Id: I401d93491999a3fc3db4f597eea9c4fe5b9bc926
| -rw-r--r-- | sw/qa/core/data/ww5/pass/hang-2.doc | bin | 0 -> 4353 bytes | |||
| -rw-r--r-- | sw/source/filter/ww8/ww8scan.cxx | 7 |
2 files changed, 3 insertions, 4 deletions
diff --git a/sw/qa/core/data/ww5/pass/hang-2.doc b/sw/qa/core/data/ww5/pass/hang-2.doc Binary files differnew file mode 100644 index 000000000000..5f76093f952e --- /dev/null +++ b/sw/qa/core/data/ww5/pass/hang-2.doc diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index 4548a4f2c5ec..19e813231002 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -6704,8 +6704,7 @@ WW8Dop::WW8Dop(SvStream& rSt, sal_Int16 nFib, sal_Int32 nPos, sal_uInt32 nSize) sal_uInt8* pData = pDataPtr; sal_uInt32 nRead = nMaxDopSize < nSize ? nMaxDopSize : nSize; - rSt.Seek( nPos ); - if (2 > nSize || nRead != rSt.Read(pData, nRead)) + if (nSize < 2 || !checkSeek(rSt, nPos) || nRead != rSt.Read(pData, nRead)) nDopError = ERR_SWG_READ_ERROR; // report error else { @@ -7550,8 +7549,8 @@ SEPr::SEPr() : bool checkSeek(SvStream &rSt, sal_uInt32 nOffset) { - return (nOffset != SAL_MAX_UINT32 && - rSt.Seek(nOffset) == static_cast<sal_Size>(nOffset)); + const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize()); + return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset); } bool checkRead(SvStream &rSt, void *pDest, sal_uInt32 nLength) |