svn commit: r1816791 - in /openoffice/trunk/main: comphelper/source/container/embeddedobjectcontainer.cxx sfx2/inc/sfx2/linkmgr.hxx sw/source/filter/ww8/ww8scan.cxx

[pats]

Author: pats
Date: Fri Dec  1 02:52:47 2017
New Revision: 1816791

URL: http://svn.apache.org/viewvc?rev=1816791&view=rev
Log:
Security fixes from 4.1.5

Modified:
    
openoffice/trunk/main/comphelper/source/container/embeddedobjectcontainer.cxx
    openoffice/trunk/main/sfx2/inc/sfx2/linkmgr.hxx
    openoffice/trunk/main/sw/source/filter/ww8/ww8scan.cxx

Modified: 
openoffice/trunk/main/comphelper/source/container/embeddedobjectcontainer.cxx
URL: 
http://svn.apache.org/viewvc/openoffice/trunk/main/comphelper/source/container/embeddedobjectcontainer.cxx?rev=1816791&r1=1816790&r2=1816791&view=diff
==============================================================================
--- 
openoffice/trunk/main/comphelper/source/container/embeddedobjectcontainer.cxx 
(original)
+++ 
openoffice/trunk/main/comphelper/source/container/embeddedobjectcontainer.cxx 
Fri Dec  1 02:52:47 2017
@@ -127,7 +127,7 @@ EmbeddedObjectContainer::EmbeddedObjectC
     pImpl = new EmbedImpl;
     pImpl->mxStorage = ::comphelper::OStorageHelper::GetTemporaryStorage();
     pImpl->mbOwnsStorage = true;
-    pImpl->mbUserAllowsLinkUpdate = false;
+    pImpl->mbUserAllowsLinkUpdate = true;
     pImpl->mpTempObjectContainer = 0;
 }
 
@@ -136,7 +136,7 @@ EmbeddedObjectContainer::EmbeddedObjectC
     pImpl = new EmbedImpl;
     pImpl->mxStorage = rStor;
     pImpl->mbOwnsStorage = false;
-    pImpl->mbUserAllowsLinkUpdate = false;
+    pImpl->mbUserAllowsLinkUpdate = true;
     pImpl->mpTempObjectContainer = 0;
 }
 
@@ -145,7 +145,7 @@ EmbeddedObjectContainer::EmbeddedObjectC
     pImpl = new EmbedImpl;
     pImpl->mxStorage = rStor;
     pImpl->mbOwnsStorage = false;
-    pImpl->mbUserAllowsLinkUpdate = false;
+    pImpl->mbUserAllowsLinkUpdate = true;
     pImpl->mpTempObjectContainer = 0;
     pImpl->m_xModel = xModel;
 }

Modified: openoffice/trunk/main/sfx2/inc/sfx2/linkmgr.hxx
URL: 
http://svn.apache.org/viewvc/openoffice/trunk/main/sfx2/inc/sfx2/linkmgr.hxx?rev=1816791&r1=1816790&r2=1816791&view=diff
==============================================================================
--- openoffice/trunk/main/sfx2/inc/sfx2/linkmgr.hxx (original)
+++ openoffice/trunk/main/sfx2/inc/sfx2/linkmgr.hxx Fri Dec  1 02:52:47 2017
@@ -111,6 +111,10 @@ public:
 
     SvLinkSourceRef CreateObj( SvBaseLink* );
 
+       
+       // Automatically ask user about update all links, on first insert
+       void SetAutoAskUpdateAllLinks();
+
        void            UpdateAllLinks( sal_Bool bAskUpdate = sal_True,
                                                                sal_Bool 
bCallErrHdl = sal_True,
                                 sal_Bool bUpdateGrfLinks = sal_False,
@@ -147,9 +151,6 @@ public:
                                                                const 
::com::sun::star::uno::Any & rValue,
                                                                Graphic& rGrf );
 
-       // Automatically ask user about update all links, on first insert
-       void SetAutoAskUpdateAllLinks();
-
 private:
                                LinkManager( const LinkManager& );
                                LinkManager& operator=( const LinkManager& );

Modified: openoffice/trunk/main/sw/source/filter/ww8/ww8scan.cxx
URL: 
http://svn.apache.org/viewvc/openoffice/trunk/main/sw/source/filter/ww8/ww8scan.cxx?rev=1816791&r1=1816790&r2=1816791&view=diff
==============================================================================
--- openoffice/trunk/main/sw/source/filter/ww8/ww8scan.cxx (original)
+++ openoffice/trunk/main/sw/source/filter/ww8/ww8scan.cxx Fri Dec  1 02:52:47 
2017
@@ -6467,6 +6467,12 @@ WW8Fonts::WW8Fonts( SvStream& rSt, WW8Fi
 
     if( nMax )
     {
+        // Check size consistency
+        if(nMax > nFFn)
+        {
+                       throw std::out_of_range("WW8 beyond end of buffer");    
        
+        }
+
         // allocate Index Array
         pFontA = new WW8_FFN[ nMax ];
         p = pFontA;