From c80754dac761b8489250c1ede510fb76b98cc590 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Mon, 18 Aug 2014 12:07:27 +0100 Subject: check len before memcpying into it valgrind + bff on sf_3e0068c9b19bb548826bed0599f65745-CrdWMI-minimized.gif Change-Id: I74cc21609f1c97a27e13615593f678cbbc8463e3 (cherry picked from commit d4e64d030092984077021a9af9d281cd64c476bf) Reviewed-on: https://gerrit.libreoffice.org/10991 Reviewed-by: Markus Mohrhard Tested-by: Markus Mohrhard --- connectivity/source/drivers/dbase/DTable.cxx | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/connectivity/source/drivers/dbase/DTable.cxx b/connectivity/source/drivers/dbase/DTable.cxx index 9dd02ba42865..603619417aa9 100644 --- a/connectivity/source/drivers/dbase/DTable.cxx +++ b/connectivity/source/drivers/dbase/DTable.cxx @@ -799,6 +799,7 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool (*aIter)->getPropertyValue(OMetaConnection::getPropMap().getNameByIndex(PROPERTY_ID_PRECISION)) >>= nLen; (*aIter)->getPropertyValue(OMetaConnection::getPropMap().getNameByIndex(PROPERTY_ID_TYPE)) >>= nType; } + switch(nType) { case DataType::INTEGER: @@ -875,6 +876,8 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool else if ( DataType::INTEGER == nType ) { sal_Int32 nValue = 0; + if (static_cast(nLen) > sizeof(nValue)) + return false; memcpy(&nValue, pData, nLen); *(_rRow->get())[i] = nValue; } @@ -884,6 +887,8 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool if (getBOOL((*aIter)->getPropertyValue(OMetaConnection::getPropMap().getNameByIndex(PROPERTY_ID_ISCURRENCY)))) // Currency is treated separately { sal_Int64 nValue = 0; + if (static_cast(nLen) > sizeof(nValue)) + return false; memcpy(&nValue, pData, nLen); if ( m_aScales[i-1] ) @@ -893,6 +898,8 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool } else { + if (static_cast(nLen) > sizeof(d)) + return false; memcpy(&d, pData, nLen); } @@ -1852,6 +1859,8 @@ bool ODbaseTable::UpdateBuffer(OValueRefVector& rRow, OValueRefRow pOrgRow, cons case DataType::INTEGER: { sal_Int32 nValue = thisColVal; + if (static_cast(nLen) > sizeof(nValue)) + return false; memcpy(pData,&nValue,nLen); } break; @@ -1867,10 +1876,16 @@ bool ODbaseTable::UpdateBuffer(OValueRefVector& rRow, OValueRefRow pOrgRow, cons nValue = (sal_Int64)(d * pow(10.0,(int)m_aScales[i])); else nValue = (sal_Int64)(d); + if (static_cast(nLen) > sizeof(nValue)) + return false; memcpy(pData,&nValue,nLen); } // if (getBOOL(xCol->getPropertyValue(OMetaConnection::getPropMap().getNameByIndex(PROPERTY_ID_ISCURRENCY)))) // Currency is treated separately else + { + if (static_cast(nLen) > sizeof(d)) + return false; memcpy(pData,&d,nLen); + } } break; case DataType::DECIMAL: -- cgit