summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2012-08-15 17:02:29 +0100
committerPetr Mladek <pmladek@suse.cz>2012-08-17 14:47:31 +0200
commit842850b911ee08be13f1090bf9937226828ada0a (patch)
tree6f34183eedccec394496a243d70dc423e3c1b642
parent0d2d24f7520308c64219eef7db42fb6471364878 (diff)
merge in various filter work from corelibreoffice-3-6
Change-Id: I14ca1319e7e96941037450aee59d7a926d290c71 Signed-off-by: Petr Mladek <pmladek@suse.cz>
-rw-r--r--binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx4
-rw-r--r--binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx73
2 files changed, 68 insertions, 9 deletions
diff --git a/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx b/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
index 5f9849470..87247024a 100644
--- a/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
+++ b/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
@@ -53,6 +53,10 @@ GIFReader::GIFReader( SvStream& rStm ) :
nLastPos ( rStm.Tell() ),
nLogWidth100 ( 0UL ),
nLogHeight100 ( 0UL ),
+ nGlobalWidth ( 0 ),
+ nGlobalHeight ( 0 ),
+ nImageWidth ( 0 ),
+ nImageHeight ( 0 ),
nLoops ( 1 ),
eActAction ( GLOBAL_HEADER_READING ),
bGCTransparent ( FALSE ),
diff --git a/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx b/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
index 23e111412..5f05546e4 100644
--- a/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
+++ b/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
@@ -27,6 +27,7 @@
************************************************************************/
#include "winmtf.hxx"
+#include <boost/scoped_array.hpp>
#include <rtl/crc.h>
#include <rtl/tencinfo.h>
#include <osl/endian.h>
@@ -329,28 +330,54 @@ void WMFReader::ReadRecordParams( USHORT nFunc )
case W_META_POLYPOLYGON:
{
- USHORT i, nPoly, nPoints;
- USHORT* pnPoints;
+ bool bRecordOk = true;
+ USHORT i, nPoly = 0, nPoints = 0;
Point* pPtAry;
// Anzahl der Polygone:
*pWMF >> nPoly;
// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
- pnPoints = new USHORT[ nPoly ];
- nPoints = 0;
+ boost::scoped_array<USHORT> xPolygonPointCounts(new USHORT[nPoly]);
+ USHORT* pnPoints = xPolygonPointCounts.get();
for( i = 0; i < nPoly; i++ )
{
*pWMF >> pnPoints[i];
- nPoints = nPoints + pnPoints[i];
+
+ if (pnPoints[i] > SAL_MAX_UINT16 - nPoints)
+ {
+ bRecordOk = false;
+ break;
+ }
+
+ nPoints += pnPoints[i];
}
+
+ SAL_WARN_IF(!bRecordOk, "svtools", "polypolygon record has more polygons than we can handle");
+
+ bRecordOk &= pWMF->good();
+
+ if (!bRecordOk)
+ {
+ pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
+ break;
+ }
+
// Polygonpunkte holen:
- pPtAry = (Point*) new char[ nPoints * sizeof(Point) ];
+ boost::scoped_array<Point> xPolygonPoints(new Point[nPoints]);
+ pPtAry = xPolygonPoints.get();
for ( i = 0; i < nPoints; i++ )
pPtAry[ i ] = ReadPoint();
+
+ bRecordOk &= pWMF->good();
+
+ if (!bRecordOk)
+ {
+ pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
+ break;
+ }
+
// PolyPolygon Actions erzeugen
PolyPolygon aPolyPoly( nPoly, pnPoints, pPtAry );
pOut->DrawPolyPolygon( aPolyPoly );
- delete[] (char*) pPtAry;
- delete[] pnPoints;
}
break;
@@ -1184,16 +1211,44 @@ sal_Bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pSt
case W_META_POLYPOLYGON:
{
+ bool bRecordOk = true;
USHORT i, nPoly, nPoints = 0;
*pStm >> nPoly;
for( i = 0; i < nPoly; i++ )
{
- sal_uInt16 nP;
+ sal_uInt16 nP = 0;
*pStm >> nP;
nPoints = nPoints + nP;
+ if (nP > SAL_MAX_UINT16 - nPoints)
+ {
+ bRecordOk = false;
+ break;
+ }
+ nPoints += nP;
}
+
+ SAL_WARN_IF(!bRecordOk, "svtools", "polypolygon record has more polygons than we can handle");
+
+ bRecordOk &= pStm->good();
+
+ if (!bRecordOk)
+ {
+ pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+ bRet = sal_False;
+ break;
+ }
+
for ( i = 0; i < nPoints; i++ )
GetWinExtMax( ReadPoint(), rPlaceableBound, nMapMode );
+
+ bRecordOk &= pStm->good();
+
+ if (!bRecordOk)
+ {
+ pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+ bRet = sal_False;
+ break;
+ }
}
break;