diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-03-01 14:11:47 +0000 |
|---|---|---|
| committer | Michael Stahl <mstahl@redhat.com> | 2017-03-03 16:16:17 +0000 |
| commit | fb604dd5340ddb367f11ab53966cae1bd549863c (patch) | |
| tree | ab0b3e7db7af6ef62872b7799af1f1568ba458f1 | |
| parent | 7b64bb4f9421879ad56ba69d3f8dd249eb42d8f0 (diff) | |
ofz: oom on seeks past end of SvMemoryStream
cause it grows to fit if its a resizable stream
Change-Id: I28b42becdfc8eb591d19d2512cdc1f1ec32c3bbe
(cherry picked from commit a42d9c5b541d637dcf24086e30f341b30e03c4c7)
Reviewed-on: https://gerrit.libreoffice.org/34753
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
| -rw-r--r-- | lotuswordpro/source/filter/lwpfilter.cxx | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/lotuswordpro/source/filter/lwpfilter.cxx b/lotuswordpro/source/filter/lwpfilter.cxx index 0389ee3cbaf9..9a3bcfcdfb5d 100644 --- a/lotuswordpro/source/filter/lwpfilter.cxx +++ b/lotuswordpro/source/filter/lwpfilter.cxx @@ -104,7 +104,7 @@ using namespace OpenStormBento; bool Decompress(SvStream *pCompressed, SvStream * & pOutDecompressed) { pCompressed->Seek(0); - std::unique_ptr<SvStream> aDecompressed(new SvMemoryStream(4096, 4096)); + std::unique_ptr<SvMemoryStream> aDecompressed(new SvMemoryStream(4096, 4096)); unsigned char buffer[512]; pCompressed->ReadBytes(buffer, 16); aDecompressed->WriteBytes(buffer, 16); @@ -132,6 +132,9 @@ using namespace OpenStormBento; while (sal_uInt32 iRead = pCompressed->ReadBytes(buffer, 512)) aDecompressed->WriteBytes(buffer, iRead); + // disable stream growing past its current size + aDecompressed->SetResizeOffset(0); + //transfer ownership of aDecompressed's ptr pOutDecompressed = aDecompressed.release(); return true; |