diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-03-01 14:11:47 +0000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-03-06 17:56:47 +0100 |
| commit | 6dc4a3b254e4cf852e7e1c4d17117df55e0c160b (patch) | |
| tree | 8926c368f3672366ef12536d00d294501b2d40cf /lotuswordpro | |
| parent | 83e479913cbcb38bd75ed60bf1389af62c7d5841 (diff) | |
ofz: oom on seeks past end of SvMemoryStream
cause it grows to fit if its a resizable stream
Change-Id: I28b42becdfc8eb591d19d2512cdc1f1ec32c3bbe
(cherry picked from commit a42d9c5b541d637dcf24086e30f341b30e03c4c7)
Reviewed-on: https://gerrit.libreoffice.org/34754
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit 19561b0a54d0753db860e3b06b7b2ebba45a801c)
Diffstat (limited to 'lotuswordpro')
| -rw-r--r-- | lotuswordpro/source/filter/lwpfilter.cxx | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/lotuswordpro/source/filter/lwpfilter.cxx b/lotuswordpro/source/filter/lwpfilter.cxx index 5326e0cc99c3..1a551c228889 100644 --- a/lotuswordpro/source/filter/lwpfilter.cxx +++ b/lotuswordpro/source/filter/lwpfilter.cxx @@ -105,7 +105,7 @@ using namespace OpenStormBento; bool Decompress(SvStream *pCompressed, SvStream * & pOutDecompressed) { pCompressed->Seek(0); - std::unique_ptr<SvStream> aDecompressed(new SvMemoryStream(4096, 4096)); + std::unique_ptr<SvMemoryStream> aDecompressed(new SvMemoryStream(4096, 4096)); unsigned char buffer[512]; pCompressed->Read(buffer, 16); aDecompressed->Write(buffer, 16); @@ -133,6 +133,9 @@ using namespace OpenStormBento; while (sal_uInt32 iRead = pCompressed->Read(buffer, 512)) aDecompressed->Write(buffer, iRead); + // disable stream growing past its current size + aDecompressed->SetResizeOffset(0); + //transfer ownership of aDecompressed's ptr pOutDecompressed = aDecompressed.release(); return true; |