diff options
author | Caolán McNamara <caolanm@redhat.com> | 2017-03-10 10:21:41 +0000 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2017-03-10 10:22:32 +0000 |
commit | 1353ebe535732022aef4377030d86ad7153c3144 (patch) | |
tree | fb445f587b59ffc1be35df085e21d1993d1efab6 /lotuswordpro | |
parent | c299011abeb50a9fccb420d6b1e8e82924efc329 (diff) |
ofz#801 avoid oom
Change-Id: Id3167d1eb3f058543ab7596008012d51b3d242b7
Diffstat (limited to 'lotuswordpro')
-rw-r--r-- | lotuswordpro/source/filter/lwpgrfobj.cxx | 8 | ||||
-rw-r--r-- | lotuswordpro/source/filter/lwpobjstrm.cxx | 6 | ||||
-rw-r--r-- | lotuswordpro/source/filter/lwpobjstrm.hxx | 1 |
3 files changed, 15 insertions, 0 deletions
diff --git a/lotuswordpro/source/filter/lwpgrfobj.cxx b/lotuswordpro/source/filter/lwpgrfobj.cxx index 04d46160a21c..cf5cc9953e88 100644 --- a/lotuswordpro/source/filter/lwpgrfobj.cxx +++ b/lotuswordpro/source/filter/lwpgrfobj.cxx @@ -113,6 +113,14 @@ void LwpGraphicObject::Read() unsigned char *pServerContext = nullptr; if (nServerContextSize > 0) { + sal_uInt16 nMaxPossibleSize = m_pObjStrm->remainingSize(); + + if (nServerContextSize > nMaxPossibleSize) + { + SAL_WARN("lwp", "stream too short for claimed no of records"); + nServerContextSize = nMaxPossibleSize; + } + pServerContext = new unsigned char[nServerContextSize]; m_pObjStrm->QuickRead(pServerContext, static_cast<sal_uInt16>(nServerContextSize)); if (nServerContextSize > 44) diff --git a/lotuswordpro/source/filter/lwpobjstrm.cxx b/lotuswordpro/source/filter/lwpobjstrm.cxx index 8a28c9fd214a..072edf700dd2 100644 --- a/lotuswordpro/source/filter/lwpobjstrm.cxx +++ b/lotuswordpro/source/filter/lwpobjstrm.cxx @@ -155,6 +155,12 @@ void LwpObjectStream::ReleaseBuffer() } } } + +sal_uInt16 LwpObjectStream::remainingSize() const +{ + return m_nBufSize - m_nReadPos; +} + /** * @descr read len bytes from object stream to buffer */ diff --git a/lotuswordpro/source/filter/lwpobjstrm.hxx b/lotuswordpro/source/filter/lwpobjstrm.hxx index 918659da82b4..83062eebd0e8 100644 --- a/lotuswordpro/source/filter/lwpobjstrm.hxx +++ b/lotuswordpro/source/filter/lwpobjstrm.hxx @@ -85,6 +85,7 @@ private: LwpSvStream* m_pStrm; bool m_bCompressed; public: + sal_uInt16 remainingSize() const; sal_uInt16 QuickRead(void* buf, sal_uInt16 len); sal_uInt16 GetPos() { return m_nReadPos; } void SeekRel(sal_uInt16 pos); |