From 6dc4a3b254e4cf852e7e1c4d17117df55e0c160b Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Wed, 1 Mar 2017 14:11:47 +0000 Subject: ofz: oom on seeks past end of SvMemoryStream cause it grows to fit if its a resizable stream Change-Id: I28b42becdfc8eb591d19d2512cdc1f1ec32c3bbe (cherry picked from commit a42d9c5b541d637dcf24086e30f341b30e03c4c7) Reviewed-on: https://gerrit.libreoffice.org/34754 Tested-by: Jenkins Reviewed-by: Michael Stahl (cherry picked from commit 19561b0a54d0753db860e3b06b7b2ebba45a801c) --- lotuswordpro/source/filter/lwpfilter.cxx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'lotuswordpro') diff --git a/lotuswordpro/source/filter/lwpfilter.cxx b/lotuswordpro/source/filter/lwpfilter.cxx index 5326e0cc99c3..1a551c228889 100644 --- a/lotuswordpro/source/filter/lwpfilter.cxx +++ b/lotuswordpro/source/filter/lwpfilter.cxx @@ -105,7 +105,7 @@ using namespace OpenStormBento; bool Decompress(SvStream *pCompressed, SvStream * & pOutDecompressed) { pCompressed->Seek(0); - std::unique_ptr aDecompressed(new SvMemoryStream(4096, 4096)); + std::unique_ptr aDecompressed(new SvMemoryStream(4096, 4096)); unsigned char buffer[512]; pCompressed->Read(buffer, 16); aDecompressed->Write(buffer, 16); @@ -133,6 +133,9 @@ using namespace OpenStormBento; while (sal_uInt32 iRead = pCompressed->Read(buffer, 512)) aDecompressed->Write(buffer, iRead); + // disable stream growing past its current size + aDecompressed->SetResizeOffset(0); + //transfer ownership of aDecompressed's ptr pOutDecompressed = aDecompressed.release(); return true; -- cgit