diff options
author | Michael Stahl <mstahl@redhat.com> | 2017-05-10 21:19:58 +0200 |
---|---|---|
committer | Michael Stahl <mstahl@redhat.com> | 2017-05-10 22:00:58 +0200 |
commit | 088b898856a82d7ac4851a6e7dfe4d189d881f8e (patch) | |
tree | 2cbef287160940de73131110758cb5f932b96012 | |
parent | db7bddbff203cb624ba61f4f72b04d4de6253d4c (diff) |
tdf#107709 filter: MSO2003XML import: fix invalid OLE lengths
The oleLength was -28160 for the bugdoc, so i guess the shifting of
signed chars there is perhaps not ideal, better upcast and
shift as unsigned.
Change-Id: I068013a10e18043c1534c7c61be8ff8a5556d460
-rw-r--r-- | filter/source/xsltfilter/OleHandler.cxx | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/filter/source/xsltfilter/OleHandler.cxx b/filter/source/xsltfilter/OleHandler.cxx index 6564d2ea88a9..2f2bd04f9eef 100644 --- a/filter/source/xsltfilter/OleHandler.cxx +++ b/filter/source/xsltfilter/OleHandler.cxx @@ -117,8 +117,14 @@ namespace XSLT { return "Can not read the length."; } - int oleLength = (aLength[0] << 0) + (aLength[1] << 8) - + (aLength[2] << 16) + (aLength[3] << 24); + sal_Int32 const oleLength = (static_cast<sal_uInt8>(aLength[0]) << 0U) + | (static_cast<sal_uInt8>(aLength[1]) << 8U) + | (static_cast<sal_uInt8>(aLength[2]) << 16U) + | (static_cast<sal_uInt8>(aLength[3]) << 24U); + if (oleLength < 0) + { + return "invalid oleLength"; + } Sequence<sal_Int8> content(oleLength); //Read all bytes. The compressed length should less then the uncompressed length readbytes = subStream->readBytes(content, oleLength); |