diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-08-31 13:21:19 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-08-31 13:23:45 +0100 |
| commit | 858257d465b7e7ce54819cc2f631efcb20632863 (patch) | |
| tree | d9b3eefac237d1e7a92d52d676fc6f671770f7d7 /sw | |
| parent | 43691a15b332193341884e0bb40d24601fe123fe (diff) | |
check for ridiculous lengths and check stream status
Change-Id: Iefe943794e005f03b2a6ea5fc642b8c3d21b3334
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/qa/core/data/ww8/pass/hang-6.doc | bin | 0 -> 28160 bytes | |||
| -rw-r--r-- | sw/source/filter/ww8/ww8par.cxx | 22 |
2 files changed, 13 insertions, 9 deletions
diff --git a/sw/qa/core/data/ww8/pass/hang-6.doc b/sw/qa/core/data/ww8/pass/hang-6.doc Binary files differnew file mode 100644 index 000000000000..48293c5fa93e --- /dev/null +++ b/sw/qa/core/data/ww8/pass/hang-6.doc diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx index b476bb8b4841..b02ae7199ac6 100644 --- a/sw/source/filter/ww8/ww8par.cxx +++ b/sw/source/filter/ww8/ww8par.cxx @@ -679,16 +679,22 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt, SEEK_FROM_CURRENT_AND_RESTART ) && maShapeRecords.Current()->nRecLen ) { - sal_uInt32 nBytesLeft = maShapeRecords.Current()->nRecLen; - sal_uInt32 nUDData; - sal_uInt16 nPID; + sal_uInt32 nBytesLeft = maShapeRecords.Current()->nRecLen; + auto nAvailableBytes = rSt.remainingSize(); + if (nBytesLeft > nAvailableBytes) + { + SAL_WARN("sw.ww8", "Document claimed to have shape record of " << nBytesLeft << " bytes, but only " << nAvailableBytes << " available"); + nBytesLeft = nAvailableBytes; + } while( 5 < nBytesLeft ) { - rSt.ReadUInt16( nPID ); - if ( rSt.GetError() != 0 ) + sal_uInt16 nPID(0); + rSt.ReadUInt16(nPID); + sal_uInt32 nUDData(0); + rSt.ReadUInt32(nUDData); + if (!rSt.good()) break; - rSt.ReadUInt32( nUDData ); - switch( nPID ) + switch (nPID) { case 0x038F: pImpRec->nXAlign = nUDData; break; case 0x0390: @@ -716,8 +722,6 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt, pImpRec->isHorizontalRule = true; break; } - if ( rSt.GetError() != 0 ) - break; nBytesLeft -= 6; } } |