From 575aac6ddbed1eba9c2941e0b31ac5ae08eed58d Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Tue, 16 Jan 2018 15:58:44 +0000
Subject: ofz#5420 Out-of-memory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I22166a14a03e5e803f8f032034e05a2da501379f
Reviewed-on: https://gerrit.libreoffice.org/48008
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 lotuswordpro/inc/lwpsvstream.hxx           |  3 ++-
 lotuswordpro/source/filter/lwp9reader.cxx  | 24 ++++++++++++++----------
 lotuswordpro/source/filter/lwp9reader.hxx  |  6 +++---
 lotuswordpro/source/filter/lwpfilter.cxx   |  7 +++++--
 lotuswordpro/source/filter/lwpsvstream.cxx |  9 +++++++--
 5 files changed, 31 insertions(+), 18 deletions(-)

(limited to 'lotuswordpro')

diff --git a/lotuswordpro/inc/lwpsvstream.hxx b/lotuswordpro/inc/lwpsvstream.hxx
index f151dafc982e..d39aee929e7b 100644
--- a/lotuswordpro/inc/lwpsvstream.hxx
+++ b/lotuswordpro/inc/lwpsvstream.hxx
@@ -70,7 +70,8 @@ public:
     sal_Int32 Read( void* bytes, sal_Int32 nBytesToRead );
     void SeekRel( sal_Int64 pos );
     sal_Int64 Tell();
-    sal_Int64 Seek( sal_Int64 pos );
+    sal_Int64 Seek(sal_Int64 pos);
+    bool CheckSeek(sal_Int64 pos);
 
     LwpSvStream& ReadUInt8( sal_uInt8& rUInt8 );
     LwpSvStream& ReadUInt16( sal_uInt16& rUInt16 );
diff --git a/lotuswordpro/source/filter/lwp9reader.cxx b/lotuswordpro/source/filter/lwp9reader.cxx
index 60a2911a7ca9..e278fc8e1a88 100644
--- a/lotuswordpro/source/filter/lwp9reader.cxx
+++ b/lotuswordpro/source/filter/lwp9reader.cxx
@@ -75,20 +75,22 @@ Lwp9Reader::Lwp9Reader (LwpSvStream* pInputStream, IXFStream* pStream)
 /**
  * @descr   The entrance of Word Pro 9 import filter.
  **/
-void Lwp9Reader::Read()
+bool Lwp9Reader::Read()
 {
+    bool bRet = true;
     LwpGlobalMgr* pGlobal = LwpGlobalMgr::GetInstance(m_pDocStream);
     try
     {
         m_pObjMgr = pGlobal->GetLwpObjFactory();
 
-        ReadFileHeader();
         //Does not support Word Pro 96 and previous versions
-        if(LwpFileHeader::m_nFileRevision>=0x000B)
+        if (ReadFileHeader() && LwpFileHeader::m_nFileRevision>=0x000B)
         {
             ReadIndex();
-            ParseDocument();
+            bRet = ParseDocument();
         }
+        else
+            bRet = false;
     }
     catch(...)
     {
@@ -96,14 +98,16 @@ void Lwp9Reader::Read()
         throw;
     }
     LwpGlobalMgr::DeleteInstance();
+    return bRet;
 }
 
 /**
  * @descr   Read the LWP7 object.
  */
-void Lwp9Reader::ReadFileHeader()
+bool Lwp9Reader::ReadFileHeader()
 {
-    m_pDocStream->Seek(LwpSvStream::LWP_STREAM_BASE);
+    if (!m_pDocStream->CheckSeek(LwpSvStream::LWP_STREAM_BASE))
+        return false;
 
     //Remember to initialize the LwpFileHeader::m_nFileRevision first.
     LwpFileHeader::m_nFileRevision = 0;
@@ -112,8 +116,7 @@ void Lwp9Reader::ReadFileHeader()
     objHdr.Read(*m_pDocStream);
     sal_Int64 pos = m_pDocStream->Tell();
     m_LwpFileHdr.Read(m_pDocStream);
-    m_pDocStream->Seek(pos+objHdr.GetSize());
-
+    return m_pDocStream->CheckSeek(pos + objHdr.GetSize());
 }
 
 /**
@@ -131,7 +134,7 @@ void Lwp9Reader::ReadIndex()
 /**
  * @descr       Parse all document content
 */
-void Lwp9Reader::ParseDocument()
+bool Lwp9Reader::ParseDocument()
 {
     WriteDocHeader();
 
@@ -139,7 +142,7 @@ void Lwp9Reader::ParseDocument()
     LwpDocument* doc = dynamic_cast<LwpDocument*> ( m_LwpFileHdr.GetDocID().obj().get() );
 
     if (!doc)
-        return;
+        return false;
 
     //Parse Doc Data
     LwpDocData *pDocData = dynamic_cast<LwpDocData*>(doc->GetDocData().obj().get());
@@ -165,6 +168,7 @@ void Lwp9Reader::ParseDocument()
     m_pStream->EndElement("office:body");
 
     WriteDocEnd();
+    return true;
 }
 
 /**
diff --git a/lotuswordpro/source/filter/lwp9reader.hxx b/lotuswordpro/source/filter/lwp9reader.hxx
index 731d940c1a71..b3bb40c968e3 100644
--- a/lotuswordpro/source/filter/lwp9reader.hxx
+++ b/lotuswordpro/source/filter/lwp9reader.hxx
@@ -74,13 +74,13 @@ private:
     IXFStream*        m_pStream;
     LwpObjectFactory* m_pObjMgr;
     LwpFileHeader     m_LwpFileHdr;             //LWP7 object
-    void ReadFileHeader();
+    bool ReadFileHeader();
     void ReadIndex();
-    void ParseDocument();
+    bool ParseDocument();
     void WriteDocHeader();
     void WriteDocEnd();
 public:
-    void Read();
+    bool Read();
 };
 #endif
 
diff --git a/lotuswordpro/source/filter/lwpfilter.cxx b/lotuswordpro/source/filter/lwpfilter.cxx
index 3b37ac1d9e94..a6ac2ee17caa 100644
--- a/lotuswordpro/source/filter/lwpfilter.cxx
+++ b/lotuswordpro/source/filter/lwpfilter.cxx
@@ -183,6 +183,7 @@ bool Decompress(SvStream *pCompressed, SvStream * & pOutDecompressed)
 }
 int ReadWordproFile(SvStream &rStream, uno::Reference<css::xml::sax::XDocumentHandler> const & xHandler)
 {
+    int nRet = 0;
     try
     {
         LwpSvStream *pRawLwpSvStream = nullptr;
@@ -211,13 +212,15 @@ int ReadWordproFile(SvStream &rStream, uno::Reference<css::xml::sax::XDocumentHa
         Lwp9Reader reader(aLwpSvStream.get(), pStrm.get());
         //Reset all static objects,because this function may be called many times.
         XFGlobalReset();
-        reader.Read();
+        const bool bOk = reader.Read();
+        if (!bOk)
+            nRet = 1;
     }
     catch (...)
     {
         return 1;
     }
-    return 0;
+    return nRet;
 }
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/lotuswordpro/source/filter/lwpsvstream.cxx b/lotuswordpro/source/filter/lwpsvstream.cxx
index b6b065e3e8e5..723d8c333a54 100644
--- a/lotuswordpro/source/filter/lwpsvstream.cxx
+++ b/lotuswordpro/source/filter/lwpsvstream.cxx
@@ -101,14 +101,19 @@ void LwpSvStream::SeekRel(sal_Int64 pos)
 */
 sal_Int64 LwpSvStream::Tell()
 {
-        return m_pStream->Tell();
+    return m_pStream->Tell();
 }
 /**
  * @descr       Seek to pos
 */
 sal_Int64 LwpSvStream::Seek(sal_Int64 pos)
 {
-        return m_pStream->Seek(pos);
+    return m_pStream->Seek(pos);
+}
+
+bool LwpSvStream::CheckSeek(sal_Int64 pos)
+{
+    return checkSeek(*m_pStream, pos);
 }
 /**
  * @descr       Return the stream data length
-- 
cgit