From a42d9c5b541d637dcf24086e30f341b30e03c4c7 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Wed, 1 Mar 2017 14:11:47 +0000 Subject: ofz: oom on seeks past end of SvMemoryStream cause it grows to fit if its a resizable stream Change-Id: I28b42becdfc8eb591d19d2512cdc1f1ec32c3bbe --- lotuswordpro/source/filter/lwpfilter.cxx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lotuswordpro/source/filter/lwpfilter.cxx b/lotuswordpro/source/filter/lwpfilter.cxx index f2fe380df0a4..8f8c8a365209 100644 --- a/lotuswordpro/source/filter/lwpfilter.cxx +++ b/lotuswordpro/source/filter/lwpfilter.cxx @@ -104,7 +104,7 @@ using namespace OpenStormBento; bool Decompress(SvStream *pCompressed, SvStream * & pOutDecompressed) { pCompressed->Seek(0); - std::unique_ptr aDecompressed(new SvMemoryStream(4096, 4096)); + std::unique_ptr aDecompressed(new SvMemoryStream(4096, 4096)); unsigned char buffer[512]; pCompressed->ReadBytes(buffer, 16); aDecompressed->WriteBytes(buffer, 16); @@ -136,6 +136,9 @@ bool Decompress(SvStream *pCompressed, SvStream * & pOutDecompressed) while (sal_uInt32 iRead = pCompressed->ReadBytes(buffer, 512)) aDecompressed->WriteBytes(buffer, iRead); + // disable stream growing past its current size + aDecompressed->SetResizeOffset(0); + //transfer ownership of aDecompressed's ptr pOutDecompressed = aDecompressed.release(); return true; -- cgit