merge in various filter work from corelibreoffice-3-6

Change-Id: I14ca1319e7e96941037450aee59d7a926d290c71
Signed-off-by: Petr Mladek <pmladek@suse.cz>

2 files changed, 68 insertions, 9 deletions

diff --git a/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx b/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
index 5f9849470..87247024a 100644
--- a/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
+++ b/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
@@ -53,6 +53,10 @@ GIFReader::GIFReader( SvStream& rStm ) :
             nLastPos        ( rStm.Tell() ),
             nLogWidth100    ( 0UL ),
             nLogHeight100   ( 0UL ),
+            nGlobalWidth    ( 0 ),
+            nGlobalHeight   ( 0 ),
+            nImageWidth     ( 0 ),
+            nImageHeight    ( 0 ),
             nLoops          ( 1 ),
             eActAction      ( GLOBAL_HEADER_READING ),
             bGCTransparent  ( FALSE ),
diff --git a/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx b/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
index 23e111412..5f05546e4 100644
--- a/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
+++ b/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
@@ -27,6 +27,7 @@
  ************************************************************************/
 
 #include "winmtf.hxx"
+#include <boost/scoped_array.hpp>
 #include <rtl/crc.h>
 #include <rtl/tencinfo.h>
 #include <osl/endian.h>
@@ -329,28 +330,54 @@ void WMFReader::ReadRecordParams( USHORT nFunc )
 
         case W_META_POLYPOLYGON:
         {
-            USHORT  i, nPoly, nPoints;
-            USHORT* pnPoints;
+            bool bRecordOk = true;
+            USHORT  i, nPoly = 0, nPoints = 0;
             Point*  pPtAry;
             // Anzahl der Polygone:
             *pWMF >> nPoly;
             // Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
-            pnPoints = new USHORT[ nPoly ];
-            nPoints = 0;
+            boost::scoped_array<USHORT> xPolygonPointCounts(new USHORT[nPoly]);
+            USHORT* pnPoints = xPolygonPointCounts.get();
             for( i = 0; i < nPoly; i++ )
             {
                 *pWMF >> pnPoints[i];
-                nPoints = nPoints + pnPoints[i];
+
+                if (pnPoints[i] > SAL_MAX_UINT16 - nPoints)
+                {
+                    bRecordOk = false;
+                    break;
+                }
+
+                nPoints += pnPoints[i];
             }
+
+            SAL_WARN_IF(!bRecordOk, "svtools", "polypolygon record has more polygons than we can handle");
+
+            bRecordOk &= pWMF->good();
+
+            if (!bRecordOk)
+            {
+                pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                break;
+            }
+
             // Polygonpunkte holen:
-            pPtAry  = (Point*) new char[ nPoints * sizeof(Point) ];
+            boost::scoped_array<Point> xPolygonPoints(new Point[nPoints]);
+            pPtAry = xPolygonPoints.get();
             for ( i = 0; i < nPoints; i++ )
                 pPtAry[ i ] = ReadPoint();
+
+            bRecordOk &= pWMF->good();
+
+            if (!bRecordOk)
+            {
+                pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                break;
+            }
+
             // PolyPolygon Actions erzeugen
             PolyPolygon aPolyPoly( nPoly, pnPoints, pPtAry );
             pOut->DrawPolyPolygon( aPolyPoly );
-            delete[] (char*) pPtAry;
-            delete[] pnPoints;
         }
         break;
 
@@ -1184,16 +1211,44 @@ sal_Bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pSt
 
                 case W_META_POLYPOLYGON:
                 {
+                    bool bRecordOk = true;
                     USHORT  i, nPoly, nPoints = 0;
                     *pStm >> nPoly;
                     for( i = 0; i < nPoly; i++ )
                     {
-                        sal_uInt16 nP;
+                        sal_uInt16 nP = 0;
                         *pStm >> nP;
                         nPoints = nPoints + nP;
+                        if (nP > SAL_MAX_UINT16 - nPoints)
+                        {
+                            bRecordOk = false;
+                            break;
+                        }
+                        nPoints += nP;
                     }
+
+                    SAL_WARN_IF(!bRecordOk, "svtools", "polypolygon record has more polygons than we can handle");
+
+                    bRecordOk &= pStm->good();
+
+                    if (!bRecordOk)
+                    {
+                        pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                        bRet = sal_False;
+                        break;
+                    }
+
                     for ( i = 0; i < nPoints; i++ )
                         GetWinExtMax( ReadPoint(), rPlaceableBound, nMapMode );
+
+                    bRecordOk &= pStm->good();
+
+                    if (!bRecordOk)
+                    {
+                        pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                        bRet = sal_False;
+                        break;
+                    }
                 }
                 break;