From f0c2e0d27ccdeaefb00b63e7462e1c25e18f73af Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Wed, 29 Jan 2020 17:17:24 +0000 Subject: cid#1458020 Untrusted loop bound MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cid#1458018 Untrusted loop bound cid#1242844 Untrusted loop bound Change-Id: I9062240290708f4b51b0ce42a30897b50d1a2677 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/87702 Tested-by: Jenkins Reviewed-by: Caolán McNamara --- filter/source/msfilter/mstoolbar.cxx | 5 +++-- filter/source/msfilter/svdfppt.cxx | 39 ++++++++++++++++++++---------------- svl/source/items/macitem.cxx | 15 +++++++------- 3 files changed, 33 insertions(+), 26 deletions(-) diff --git a/filter/source/msfilter/mstoolbar.cxx b/filter/source/msfilter/mstoolbar.cxx index f44cd2bbb3ca..e32181019602 100644 --- a/filter/source/msfilter/mstoolbar.cxx +++ b/filter/source/msfilter/mstoolbar.cxx @@ -676,10 +676,11 @@ bool TBCCDData::Read( SvStream &rS) rS.ReadInt16( cwstrItems ); if (cwstrItems > 0) { + auto nItems = o3tl::make_unsigned(cwstrItems); //each WString is at least one byte - if (rS.remainingSize() < o3tl::make_unsigned(cwstrItems)) + if (rS.remainingSize() < nItems) return false; - for( sal_Int32 index=0; index < cwstrItems; ++index ) + for (decltype(nItems) index = 0; index < nItems; ++index) { WString aString; if ( !aString.Read( rS ) ) diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx index 1cae88f4870f..a1c57622f865 100644 --- a/filter/source/msfilter/svdfppt.cxx +++ b/filter/source/msfilter/svdfppt.cxx @@ -1213,24 +1213,29 @@ SdrObject* SdrEscherImport::ProcessObj( SvStream& rSt, DffObjData& rObjData, Svx { if ( aSecPropSet.SeekToContent( DFF_Prop_tableRowProperties, rSt ) ) { - sal_Int16 i, nRowCount = 0; - rSt.ReadInt16( nRowCount ).ReadInt16( i ).ReadInt16( i ); - const size_t nMinRecordSize = 4; - const size_t nMaxRecords = rSt.remainingSize() / nMinRecordSize; - if (nRowCount > 0 && o3tl::make_unsigned(nRowCount) > nMaxRecords) + sal_Int16 i, nReadRowCount = 0; + rSt.ReadInt16( nReadRowCount ).ReadInt16( i ).ReadInt16( i ); + if (nReadRowCount > 0) { - SAL_WARN("filter.ms", "Parsing error: " << nMaxRecords << - " max possible entries, but " << nRowCount << " claimed, truncating"); - nRowCount = nMaxRecords; - } - if (nRowCount > 0) - { - std::unique_ptr pTableArry(new sal_uInt32[ nRowCount + 2 ]); - pTableArry[ 0 ] = nTableProperties; - pTableArry[ 1 ] = nRowCount; - for ( i = 0; i < nRowCount; i++ ) - rSt.ReadUInt32( pTableArry[ i + 2 ] ); - rData.pTableRowProperties = std::move(pTableArry); + const size_t nMinRecordSize = 4; + const size_t nMaxRecords = rSt.remainingSize() / nMinRecordSize; + + auto nRowCount = o3tl::make_unsigned(nReadRowCount); + if (nRowCount > nMaxRecords) + { + SAL_WARN("filter.ms", "Parsing error: " << nMaxRecords << + " max possible entries, but " << nRowCount << " claimed, truncating"); + nRowCount = nMaxRecords; + } + if (nRowCount > 0) + { + std::unique_ptr pTableArry(new sal_uInt32[ nRowCount + 2 ]); + pTableArry[ 0 ] = nTableProperties; + pTableArry[ 1 ] = nRowCount; + for (decltype(nRowCount) nRow = 0; nRow < nRowCount; ++nRow) + rSt.ReadUInt32(pTableArry[nRow + 2]); + rData.pTableRowProperties = std::move(pTableArry); + } } } } diff --git a/svl/source/items/macitem.cxx b/svl/source/items/macitem.cxx index 64a22aa0039c..b0750212e3dc 100644 --- a/svl/source/items/macitem.cxx +++ b/svl/source/items/macitem.cxx @@ -86,28 +86,30 @@ void SvxMacroTableDtor::Read( SvStream& rStrm ) sal_uInt16 nVersion; rStrm.ReadUInt16( nVersion ); - short nMacro(0); - rStrm.ReadInt16(nMacro); - if (nMacro < 0) + short nReadMacro(0); + rStrm.ReadInt16(nReadMacro); + if (nReadMacro < 0) { - SAL_WARN("editeng", "Parsing error: negative value " << nMacro); + SAL_WARN("editeng", "Parsing error: negative value " << nReadMacro); return; } + auto nMacro = o3tl::make_unsigned(nReadMacro); + const size_t nMinStringSize = rStrm.GetStreamCharSet() == RTL_TEXTENCODING_UNICODE ? 4 : 2; size_t nMinRecordSize = 2 + 2*nMinStringSize; if( SVX_MACROTBL_VERSION40 <= nVersion ) nMinRecordSize+=2; const size_t nMaxRecords = rStrm.remainingSize() / nMinRecordSize; - if (o3tl::make_unsigned(nMacro) > nMaxRecords) + if (nMacro > nMaxRecords) { SAL_WARN("editeng", "Parsing error: " << nMaxRecords << " max possible entries, but " << nMacro<< " claimed, truncating"); nMacro = nMaxRecords; } - for (short i = 0; i < nMacro; ++i) + for (decltype(nMacro) i = 0; i < nMacro; ++i) { sal_uInt16 nCurKey, eType = STARBASIC; OUString aLibName, aMacName; @@ -122,7 +124,6 @@ void SvxMacroTableDtor::Read( SvStream& rStrm ) } } - SvStream& SvxMacroTableDtor::Write( SvStream& rStream ) const { sal_uInt16 nVersion = SOFFICE_FILEFORMAT_31 == rStream.GetVersion() -- cgit ro/lhm/libreoffice-7-3+backports LibreOffice 核心代码仓库文档基金会
summaryrefslogtreecommitdiff
path: root/test/source/text/xtextrange.cxx
ad to problematic extension of variable lifetime Change-Id: I3061f7104e8c6a460bf74f5eac325a516ec50c59 Reviewed-on: https://gerrit.libreoffice.org/42889 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
AgeCommit message (Expand)Author
2019-12-19tdf#42949 Fix IWYU warnings in test/Gabor Kelemen
2019-05-13fix wrong SET/QUERY flags passed to uno::ReferenceNoel Grandin
2019-03-03tdf#45904 Move XTextRange Java tests to C++Jens Carl
2017-09-21loplugin:flatten in connectivity..desktopNoel Grandin
Change-Id: Iff59d3049ba40b4338ef8eec67d08a96b0834d2b Reviewed-on: https://gerrit.libreoffice.org/42578 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
2017-07-13use more OUString::operator== comphelper..cuiNoel Grandin
Change-Id: Ib5f3037249152be2b66acf347d1a0c236dc7adfa Reviewed-on: https://gerrit.libreoffice.org/39888 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
2017-06-05spelling instanciate -> instantiateNoel Grandin
Change-Id: Ic1393da64328c0dc7e2860334b204139bf537d81 Reviewed-on: https://gerrit.libreoffice.org/38401 Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk> Tested-by: Noel Grandin <noel.grandin@collabora.co.uk>
2017-04-21gbuild: Remove MSVC 2013 legacy codeDavid Ostrovsky
Uwinapi is discontinued. Change-Id: I063b4d0d8fab2d60de168e960a63b8181158ac01 Reviewed-on: https://gerrit.libreoffice.org/23198 Reviewed-by: David Ostrovsky <david@ostrovsky.org> Tested-by: David Ostrovsky <david@ostrovsky.org>
2017-03-25Fix typosAndrea Gelmini
Change-Id: I56e429ff1b8ee55ccb8df16002b509770762172c Reviewed-on: https://gerrit.libreoffice.org/35618 Reviewed-by: Julien Nabet <serval2412@yahoo.fr> Tested-by: Julien Nabet <serval2412@yahoo.fr>
2017-03-11Fix typosAndrea Gelmini
Change-Id: Ic54e808956e5cf4e8079942c0ff799f802cd4b6c Reviewed-on: https://gerrit.libreoffice.org/35053 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
2017-02-28new loplugin unoanyNoel Grandin
Change-Id: I5d6c4a67cb2a09e7cd5bd620c6b262d188701b89 Reviewed-on: https://gerrit.libreoffice.org/34714 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
2017-02-24makeAny->Any in cppuhelper..cuiNoel Grandin
Change-Id: Ia54e6e9b71df68bd04c304a0bb02da8ebac74420 Reviewed-on: https://gerrit.libreoffice.org/34603 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
2017-02-21loplugin:subtlezeroinit: cpputoolsStephan Bergmann
Change-Id: Ib4a04395f067a3a288a57547daa734c4c9768eb8
2017-02-15Some simplifications, using UNO_QUERY_THROWStephan Bergmann
Change-Id: Icefafed29c9702730181f61bb03296b5b474bfa6 Reviewed-on: https://gerrit.libreoffice.org/34269 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
2017-01-26Remove dynamic exception specificationsStephan Bergmann
...(for now, from LIBO_INTERNAL_CODE only). See the mail thread starting at <https://lists.freedesktop.org/archives/libreoffice/2017-January/076665.html> "Dynamic Exception Specifications" for details. Most changes have been done automatically by the rewriting loplugin:dynexcspec (after enabling the rewriting mode, to be committed shortly). The way it only removes exception specs from declarations if it also sees a definition, it identified some dead declarations-w/o-definitions (that have been removed manually) and some cases where a definition appeared in multiple include files (which have also been cleaned up manually). There's also been cases of macro paramters (that were used to abstract over exception specs) that have become unused now (and been removed). Furthermore, some code needed to be cleaned up manually (avmedia/source/quicktime/ and connectivity/source/drivers/kab/), as I had no configurations available that would actually build that code. Missing @throws documentation has not been applied in such manual clean-up. Change-Id: I3408691256c9b0c12bc5332de976743626e13960 Reviewed-on: https://gerrit.libreoffice.org/33574 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
2017-01-19New loplugin:dynexcspec: Add @throws documentation, cpputoolsStephan Bergmann
Change-Id: I7a9ac7cdc3d5e19dc63a4711a0ce2c23054367e1
2016-03-11tdf#91794 remove OSL_DEBUG_LEVEL > 1 conditionalsRohan Kumar
I replaced OSL_DEBUG_LEVEL > 1 with OSL_DEBUG_LEVEL > 0 and made sure that it doesn't break the build Change-Id: I9febeed949a24d7bc5afb13dedde03fd812b5b20 Reviewed-on: https://gerrit.libreoffice.org/23077 Reviewed-by: Björn Michaelsen <bjoern.michaelsen@canonical.com> Tested-by: Björn Michaelsen <bjoern.michaelsen@canonical.com>
2016-02-09Remove excess newlinesChris Sherlock
A ridiculously fast way of doing this is: for i in $(pcregrep -l -M -r --include='.*[hc]xx$' \ --exclude-dir=workdir --exclude-dir=instdir '^ {3,}' .) do perl -0777 -i -pe 's/^ {3,}/ /gm' $i done Change-Id: Iebb93eccbee9e4fc5c4380474ba595858a27ac2c Reviewed-on: https://gerrit.libreoffice.org/22224 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Chris Sherlock <chris.sherlock79@gmail.com>
2015-11-10loplugin:nullptr (automatic rewrite)Stephan Bergmann
Change-Id: I65186f574c8bbc4004eb40a95a33aea1ea3f4e96
2015-11-09new loplugin: oncevarNoel Grandin
Change-Id: If57390510dde4d166be3141b9f658a7453755d3f Reviewed-on: https://gerrit.libreoffice.org/19815 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Noel Grandin <noelgrandin@gmail.com>
2015-11-06loplugin:stringconstant: elide explicit ctor usage (automatic rewrite)Stephan Bergmann
Change-Id: Iefb181010ad8514227dfe617379eeaccb8d70152
2015-10-30use uno::Reference::set method instead of assignmentNoel Grandin
Change-Id: I080668f86f0ab8b3bba857ee21411f907ae285c4
2015-10-12Replace "SAL_OVERRIDE" with "override" in LIBO_INTERNAL_ONLY codeStephan Bergmann
Change-Id: I2ea407acd763ef2d7dae2d3b8f32525523ac8274
2015-07-17tdf#88206 replace cppu::WeakImplHelper* etc.Takeshi Abe
with the variadic variants, in cppcanvas / cpputools / cui. Change-Id: Ic28d0830ab86555494004c27b1468de2ea6825dc Reviewed-on: https://gerrit.libreoffice.org/17119 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Noel Grandin <noelgrandin@gmail.com>
2015-05-29loplugin:loopvartoosmallNoel Grandin
Change-Id: Icbe68b31d4ab04ca3cd9f572e3598413946a75c7
2015-03-29Clean up template-parameter-dependent C-style castsStephan Bergmann
Change-Id: Ia1ab134a0afbeeb3ae40264bd4233a47df26b734
2014-12-12cpputools: Use appropriate OUString functions on string constantsStephan Bergmann
Change-Id: Iea0f7b4ee3ef867a061c159d90efb5d210ae92a4
2014-11-05markup with event type not checker typeCaolán McNamara
Change-Id: I14c0c5d90b67000cb4fe9e6be647854abfe784da
2014-10-28coverity#982593 experiment with silencing Infinite loopCaolán McNamara
etc. Change-Id: I1548d60280ab4f74fe023d026435a05f7865b516