diff options
author | Caolán McNamara <caolanm@redhat.com> | 2017-04-25 11:55:07 +0100 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2017-04-25 11:55:58 +0100 |
commit | 825c8f1b6e2c1e8c686f4656337fa2879ade481d (patch) | |
tree | 9e6cbeabd62c184ee8d70797dc9131e23321dda8 | |
parent | b79f9a9bc818022a59184113cf20dd5ada29deff (diff) |
ofz#1270 avoid oom
Change-Id: Iedf0ffdedea1ccda9276763c9d39924c3ff8943b
-rw-r--r-- | lotuswordpro/source/filter/bencont.cxx | 5 | ||||
-rw-r--r-- | lotuswordpro/source/filter/bento.hxx | 1 | ||||
-rw-r--r-- | lotuswordpro/source/filter/tocread.cxx | 7 |
3 files changed, 13 insertions, 0 deletions
diff --git a/lotuswordpro/source/filter/bencont.cxx b/lotuswordpro/source/filter/bencont.cxx index 8d67e3905963..ed15dc9858a6 100644 --- a/lotuswordpro/source/filter/bencont.cxx +++ b/lotuswordpro/source/filter/bencont.cxx @@ -332,6 +332,11 @@ void LtcBenContainer::CreateGraphicStream(SvStream * &pStream, const char *pObje pStream = pMemStream; } +sal_uLong LtcBenContainer::remainingSize() const +{ + return m_ulLength - cpStream->Tell(); +} + }// end namespace OpenStormBento /* vim:set shiftwidth=4 softtabstop=4 expandtab: */ diff --git a/lotuswordpro/source/filter/bento.hxx b/lotuswordpro/source/filter/bento.hxx index f5f2408d4036..9471590ed6ef 100644 --- a/lotuswordpro/source/filter/bento.hxx +++ b/lotuswordpro/source/filter/bento.hxx @@ -209,6 +209,7 @@ public: // Internal methods explicit LtcBenContainer(LwpSvStream * pStream); ~LtcBenContainer(); + sal_uLong remainingSize() const; BenError Read(void * pBuffer, unsigned long MaxSize, unsigned long * pAmtRead); BenError ReadKnownSize(void * pBuffer, unsigned long Amt); diff --git a/lotuswordpro/source/filter/tocread.cxx b/lotuswordpro/source/filter/tocread.cxx index b6c32955411b..8e7e79a855e4 100644 --- a/lotuswordpro/source/filter/tocread.cxx +++ b/lotuswordpro/source/filter/tocread.cxx @@ -267,6 +267,13 @@ CBenTOCReader::ReadTOC() if ((Err = cpContainer->SeekToPosition(Pos)) != BenErr_OK) return Err; + const auto nRemainingSize = cpContainer->remainingSize(); + if (Length > nRemainingSize) + { + SAL_WARN("lwp", "stream too short for claimed no of records"); + Length = nRemainingSize; + } + #define STACK_BUFFER_SIZE 256 char sStackBuffer[STACK_BUFFER_SIZE]; char * sAllocBuffer; |