This is an automated email from the ASF dual-hosted git repository. leginee pushed a commit to branch AOO41X in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 2d2c30bc038b4c4abb51c1ef7101f28570f4ca00 Author: Peter <[email protected]> AuthorDate: Fri Sep 18 23:43:42 2026 +0200 filter: idxf: port the input-validation hunks missed by the #491 backport PR #491 was landed on AOO41X as 3c5a7184f8 ("cherry pick and adaptation of merge commit c082241a9b"), but three hardening hunks of the series did not survive the adaptation: * DXFBoundaryPathData::EvaluateGroup, group 93: the vertex count taken from the file was used for `new DXFVector[n]` without checking the reader status or the sign. A negative or unread count reached operator new[]; a huge one threw std::bad_alloc out of the filter. Check GetStatus() and n >= 0, and turn bad_alloc into a reader error. * DXFHatchEntity::EvaluateGroup, group 91: identical problem for the boundary-path count driving `new DXFBoundaryPathData[n]`. * DXFGroupReader::ReadI: the hand-rolled do/while accumulated digits without any overflow or termination check, so it also ran once on a non-digit before testing. Parse with strtol over the digit run and reject the group unless the converted span ends exactly where the scan did. Both allocation sites are reachable from HATCH entities in an untrusted DXF, which is what makes these worth carrying over rather than leaving to the next full sync. Also fixes the "assoiciative" comment typo on nAssociativityFlag, so the file matches trunk. No functional change beyond the above: after this commit the idxf sources on AOO41X are content-identical to the #491 head (96b0524be2), modulo the trailing-whitespace cleanup trunk applied to the licence headers. Co-Authored-By: Claude Opus 5 <[email protected]> --- main/filter/source/graphicfilter/idxf/dxfentrd.cxx | 30 +++++++++++++++++++--- main/filter/source/graphicfilter/idxf/dxfentrd.hxx | 2 +- main/filter/source/graphicfilter/idxf/dxfgrprd.cxx | 23 ++++++++++------- 3 files changed, 41 insertions(+), 14 deletions(-) diff --git a/main/filter/source/graphicfilter/idxf/dxfentrd.cxx b/main/filter/source/graphicfilter/idxf/dxfentrd.cxx index 27219f03b7..0a46a63483 100644 --- a/main/filter/source/graphicfilter/idxf/dxfentrd.cxx +++ b/main/filter/source/graphicfilter/idxf/dxfentrd.cxx @@ -635,8 +635,19 @@ sal_Bool DXFBoundaryPathData::EvaluateGroup( DXFGroupReader & rDGR ) case 93 : { nPointCount = rDGR.GetI(); - if ( nPointCount ) - pP = new DXFVector[ nPointCount ]; + if ( rDGR.GetStatus() && nPointCount >= 0 ) + { + try + { + pP = new DXFVector[ nPointCount ]; + } + catch (::std::bad_alloc) + { + rDGR.SetError(); + } + } + else + rDGR.SetError(); } break; case 72 : nHasBulgeFlag = rDGR.GetI(); break; @@ -719,8 +730,19 @@ void DXFHatchEntity::EvaluateGroup( DXFGroupReader & rDGR ) { bIsInBoundaryPathContext = sal_True; nBoundaryPathCount = rDGR.GetI(); - if ( nBoundaryPathCount ) - pBoundaryPathData = new DXFBoundaryPathData[ nBoundaryPathCount ]; + if ( rDGR.GetStatus() && nBoundaryPathCount >= 0 ) + { + try + { + pBoundaryPathData = new DXFBoundaryPathData[ nBoundaryPathCount ]; + } + catch (::std::bad_alloc) + { + rDGR.SetError(); + } + } + else + rDGR.SetError(); } break; case 75 : diff --git a/main/filter/source/graphicfilter/idxf/dxfentrd.hxx b/main/filter/source/graphicfilter/idxf/dxfentrd.hxx index ffe8d6fd51..5684658ccd 100644 --- a/main/filter/source/graphicfilter/idxf/dxfentrd.hxx +++ b/main/filter/source/graphicfilter/idxf/dxfentrd.hxx @@ -474,7 +474,7 @@ class DXFHatchEntity : public DXFBasicEntity DXFVector aElevationPoint; sal_Int32 nFlags; // 70 (solid fill = 1, pattern fill = 0) - sal_Int32 nAssociativityFlag; // 71 (assoiciative = 1, non-associative = 0) + sal_Int32 nAssociativityFlag; // 71 (associative = 1, non-associative = 0) sal_Int32 nBoundaryPathCount; // 91 sal_Int32 nHatchStyle; // 75 (odd parity = 0, outmost area = 1, entire area = 2 ) sal_Int32 nHatchPatternType; // 76 (user defined = 0, predefined = 1, custom = 2) diff --git a/main/filter/source/graphicfilter/idxf/dxfgrprd.cxx b/main/filter/source/graphicfilter/idxf/dxfgrprd.cxx index 6210b18a06..c841086a82 100644 --- a/main/filter/source/graphicfilter/idxf/dxfgrprd.cxx +++ b/main/filter/source/graphicfilter/idxf/dxfgrprd.cxx @@ -299,7 +299,6 @@ void DXFGroupReader::ReadLine(char * ptgt) long DXFGroupReader::ReadI() { char sl[DXF_MAX_STRING_LEN+1],*p; - long res,nv; ReadLine(sl); @@ -312,17 +311,23 @@ long DXFGroupReader::ReadI() return 0; } + char *start = p; if (*p=='-') { - nv=-1; p++; } - else nv=1; - - res=0; - do { - res=res*10+(long)(*p-'0'); + while (*p>='0' && *p<='9') { p++; - } while (*p>='0' && *p<='9'); + } + + char prev = *p; + *p = '\0'; + char *end; + long res = strtol(start, &end, 10); + *p = prev; + if (end != p) { + bStatus=sal_False; + return 0; + } while (*p==0x20) p++; @@ -342,7 +347,7 @@ long DXFGroupReader::ReadI() return 0; } - return res*nv; + return res; }
