This is an automated email from the ASF dual-hosted git repository. ardovm pushed a commit to branch trunk in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit a076163db497445461c819d3ae9afe052eb01982 Author: Peter Kovacs <[email protected]> AuthorDate: Sun Aug 30 10:39:04 2026 +0200 Check lengths Also fix the allocation check which tested ppStream rather than *ppStream Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01UWgzQY2r1XwFvgeLPFWPsi --- .../sdext/source/pdfimport/pdfparse/pdfentries.cxx | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/main/sdext/source/pdfimport/pdfparse/pdfentries.cxx b/main/sdext/source/pdfimport/pdfparse/pdfentries.cxx index 029d45c1ee..485f951731 100644 --- a/main/sdext/source/pdfimport/pdfparse/pdfentries.cxx +++ b/main/sdext/source/pdfimport/pdfparse/pdfentries.cxx @@ -676,7 +676,7 @@ bool PDFObject::getDeflatedStream( char** ppStream, unsigned int* pBytes, const { unsigned int nOuterStreamLen = m_pStream->m_nEndOffset - m_pStream->m_nBeginOffset; *ppStream = static_cast<char*>(rtl_allocateMemory( nOuterStreamLen )); - if( ! ppStream ) + if( ! *ppStream ) { *pBytes = 0; return false; @@ -719,6 +719,12 @@ bool PDFObject::getDeflatedStream( char** ppStream, unsigned int* pBytes, const pStream++; // get the compressed length *pBytes = m_pStream->getDictLength( pObjectContainer ); + // pStream has already advanced past the "stream" keyword inside it. + const unsigned int nSkipped = + static_cast<unsigned int>( pStream - *ppStream ); + const unsigned int nAvailable = nOuterStreamLen - nSkipped; + if( *pBytes > nAvailable ) + *pBytes = nAvailable; if( pStream != *ppStream ) rtl_moveMemory( *ppStream, pStream, *pBytes ); if( rContext.m_bDecrypt ) @@ -1361,8 +1367,18 @@ PDFFileImplData* PDFFile::impl_getData() const if( len != pDict->m_aMap.end() ) { PDFNumber* pNum = dynamic_cast<PDFNumber*>(len->second); - if( pNum ) - m_pData->m_nKeyLength = static_cast<sal_uInt32>(pNum->m_fValue) / 8; + // m_aDecryptionKey holds ENCRYPTION_KEY_LEN + 5 + // bytes: the key, plus the object and generation + // numbers appended after it. + if( pNum && pNum->m_fValue > 0 ) + { + sal_uInt32 nBits = + static_cast<sal_uInt32>(pNum->m_fValue) / 8; + if( nBits > ENCRYPTION_KEY_LEN ) + nBits = ENCRYPTION_KEY_LEN; + if( nBits > 0 ) + m_pData->m_nKeyLength = nBits; + } } PDFName* pFilter = dynamic_cast<PDFName*>(filter->second); if( pFilter && pFilter->getFilteredName().equalsAscii( "Standard" ) )
