diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-03-10 10:21:41 +0000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-04-23 20:56:08 +0200 |
| commit | ff14e802b6da80710d468691ef2a0a49a5d1ea67 (patch) | |
| tree | 7cf3f4f0a0db5d94cb043b14c5b998a23eddf15c /lotuswordpro | |
| parent | 4f09b522819bba26b55ca39e190f1f4fed61344a (diff) | |
ofz#801 avoid oom
Change-Id: Id3167d1eb3f058543ab7596008012d51b3d242b7
(cherry picked from commit 1353ebe535732022aef4377030d86ad7153c3144)
Reviewed-on: https://gerrit.libreoffice.org/35037
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit b03bbb5203831bf77fb73bdb4cf19bdea29a1e1c)
(cherry picked from commit 60e7eeffa9842899535b43571c8add78e7837475)
Diffstat (limited to 'lotuswordpro')
| -rw-r--r-- | lotuswordpro/source/filter/lwpgrfobj.cxx | 8 | ||||
| -rw-r--r-- | lotuswordpro/source/filter/lwpobjstrm.cxx | 6 | ||||
| -rw-r--r-- | lotuswordpro/source/filter/lwpobjstrm.hxx | 1 |
3 files changed, 15 insertions, 0 deletions
diff --git a/lotuswordpro/source/filter/lwpgrfobj.cxx b/lotuswordpro/source/filter/lwpgrfobj.cxx index 29888eb4c1b3..715a2f81fc09 100644 --- a/lotuswordpro/source/filter/lwpgrfobj.cxx +++ b/lotuswordpro/source/filter/lwpgrfobj.cxx @@ -115,6 +115,14 @@ void LwpGraphicObject::Read() unsigned char *pServerContext = NULL; if (nServerContextSize > 0) { + sal_uInt16 nMaxPossibleSize = m_pObjStrm->remainingSize(); + + if (nServerContextSize > nMaxPossibleSize) + { + SAL_WARN("lwp", "stream too short for claimed no of records"); + nServerContextSize = nMaxPossibleSize; + } + pServerContext = new unsigned char[nServerContextSize]; m_pObjStrm->QuickRead(pServerContext, static_cast<sal_uInt16>(nServerContextSize)); if (nServerContextSize > 44) diff --git a/lotuswordpro/source/filter/lwpobjstrm.cxx b/lotuswordpro/source/filter/lwpobjstrm.cxx index 88a82936a75a..28e218443c6c 100644 --- a/lotuswordpro/source/filter/lwpobjstrm.cxx +++ b/lotuswordpro/source/filter/lwpobjstrm.cxx @@ -163,6 +163,12 @@ void LwpObjectStream::ReleaseBuffer() } } } + +sal_uInt16 LwpObjectStream::remainingSize() const +{ + return m_nBufSize - m_nReadPos; +} + /** * @descr read len bytes from object stream to buffer */ diff --git a/lotuswordpro/source/filter/lwpobjstrm.hxx b/lotuswordpro/source/filter/lwpobjstrm.hxx index 3138a496a1ed..6b3f062e533c 100644 --- a/lotuswordpro/source/filter/lwpobjstrm.hxx +++ b/lotuswordpro/source/filter/lwpobjstrm.hxx @@ -89,6 +89,7 @@ private: LwpSvStream* m_pStrm; bool m_bCompressed; public: + sal_uInt16 remainingSize() const; sal_uInt16 QuickRead(void* buf, sal_uInt16 len); sal_uInt16 GetPos() { return m_nReadPos; } void SeekRel(sal_uInt16 pos); |