lokdocview: check payload for inconsistencies before using it

Lets follow the old advice: "Be liberal in what you accept, be strict in
what you produce".

This is after noticing negative values for x, y in
the payload in some situation, such as, hitting a backspace key when the
cursor is at the start of a line

Change-Id: I11939b981f75969b88214baee66b4c69c5e41906

1 files changed, 10 insertions, 2 deletions

diff --git a/libreofficekit/source/gtk/lokdocview.cxx b/libreofficekit/source/gtk/lokdocview.cxx
index 8e43e08d07da..507e81ff6765 100644
--- a/libreofficekit/source/gtk/lokdocview.cxx
+++ b/libreofficekit/source/gtk/lokdocview.cxx
@@ -187,9 +187,9 @@ struct LOKDocView_Impl
      */
     void renderDocument(GdkRectangle* pPartial);
     /// Returns the GdkRectangle of a x,y,width,height string.
-    static GdkRectangle payloadToRectangle(const char* pPayload);
+    GdkRectangle payloadToRectangle(const char* pPayload);
     /// Returns the GdkRectangles of a x1,y1,w1,h1;x2,y2,w2,h2;... string.
-    static std::vector<GdkRectangle> payloadToRectangles(const char* pPayload);
+    std::vector<GdkRectangle> payloadToRectangles(const char* pPayload);
     /// Returns the string representation of a LibreOfficeKitCallbackType enumeration element.
     static const char* callbackTypeToString(int nType);
     /// Invoked on the main thread if callbackWorker() requests so.
@@ -853,18 +853,26 @@ GdkRectangle LOKDocView_Impl::payloadToRectangle(const char* pPayload)
     if (!*ppCoordinate)
         return aRet;
     aRet.x = atoi(*ppCoordinate);
+    if (aRet.x < 0)
+        aRet.x = 0;
     ++ppCoordinate;
     if (!*ppCoordinate)
         return aRet;
     aRet.y = atoi(*ppCoordinate);
+    if (aRet.y < 0)
+        aRet.y = 0;
     ++ppCoordinate;
     if (!*ppCoordinate)
         return aRet;
     aRet.width = atoi(*ppCoordinate);
+    if (aRet.x + aRet.width > m_nDocumentWidthTwips)
+        aRet.width = m_nDocumentWidthTwips - aRet.x;
     ++ppCoordinate;
     if (!*ppCoordinate)
         return aRet;
     aRet.height = atoi(*ppCoordinate);
+    if (aRet.y + aRet.height > m_nDocumentHeightTwips)
+        aRet.height = m_nDocumentHeightTwips - aRet.y;
     g_strfreev(ppCoordinates);
     return aRet;
 }