ofz#853 oom in svm

Change-Id: Ibe41e1edb717b4e740971f4b972abdea769460eb

1 files changed, 6 insertions, 2 deletions

diff --git a/tools/source/stream/stream.cxx b/tools/source/stream/stream.cxx
index f838edbf6087..b1efb6952495 100644
--- a/tools/source/stream/stream.cxx
+++ b/tools/source/stream/stream.cxx
@@ -1961,7 +1961,9 @@ OString read_uInt8s_ToOString(SvStream& rStrm, std::size_t nLen)
     rtl_String *pStr = nullptr;
     if (nLen)
     {
-        nLen = std::min(nLen, static_cast<std::size_t>(SAL_MAX_INT32));
+        nLen = std::min<std::size_t>(nLen, SAL_MAX_INT32);
+        //limit allocation to size of file, but + 1 to set eof state
+        nLen = std::min<sal_uInt64>(nLen, rStrm.remainingSize() + 1);
         //alloc a (ref-count 1) rtl_String of the desired length.
         //rtl_String's buffer is uninitialized, except for null termination
         pStr = rtl_string_alloc(sal::static_int_cast<sal_Int32>(nLen));
@@ -1990,7 +1992,9 @@ OUString read_uInt16s_ToOUString(SvStream& rStrm, std::size_t nLen)
     rtl_uString *pStr = nullptr;
     if (nLen)
     {
-        nLen = std::min(nLen, static_cast<std::size_t>(SAL_MAX_INT32));
+        nLen = std::min<std::size_t>(nLen, SAL_MAX_INT32);
+        //limit allocation to size of file, but + 1 to set eof state
+        nLen = std::min<sal_uInt64>(nLen, (rStrm.remainingSize() + 2) / 2);
         //alloc a (ref-count 1) rtl_uString of the desired length.
         //rtl_String's buffer is uninitialized, except for null termination
         pStr = rtl_uString_alloc(sal::static_int_cast<sal_Int32>(nLen));