This is an automated email from the ASF dual-hosted git repository.
leginee pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/openoffice.git
The following commit(s) were added to refs/heads/trunk by this push:
new 864d6d404e svtools: check the WMF private-escape text length and
advance array
864d6d404e is described below
commit 864d6d404ef6868a2971746939c3496b71cc3952
Author: Peter Kovacs <[email protected]>
AuthorDate: Sun Aug 30 01:44:53 2026 +0200
svtools: check the WMF private-escape text length and advance array
Limit the character count of a PRIVATE_ESCAPE_UNICODE record to what a
String can hold, and ignore an advance array that has fewer entries than
the text has characters, as if it were missing.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---
main/svtools/source/filter/wmf/winwmf.cxx | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/main/svtools/source/filter/wmf/winwmf.cxx
b/main/svtools/source/filter/wmf/winwmf.cxx
index 94f28877a3..8827051d11 100644
--- a/main/svtools/source/filter/wmf/winwmf.cxx
+++ b/main/svtools/source/filter/wmf/winwmf.cxx
@@ -898,6 +898,10 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
>> aPt.Y()
>> nStringLen;
+
// AllocBuffer takes an xub_StrLen
+
if ( nStringLen >= STRING_MAXLEN )
+
break;
+
if ( ( static_cast< sal_uInt64 >( nStringLen ) * sizeof( sal_Unicode )
) < ( nEscLen - aMemoryStream.Tell() ) )
{
sal_Unicode* pBuf = aString.AllocBuffer( (xub_StrLen)nStringLen
);
@@ -906,6 +910,9 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
aMemoryStream >> nDXCount;
if ( ( static_cast< sal_uInt64 >( nDXCount ) * sizeof(
sal_Int32 ) ) >= ( nEscLen - aMemoryStream.Tell() ) )
nDXCount = 0;
+
// one advance per character; ignore a shorter array
+
if ( nDXCount && ( nDXCount < nStringLen ) )
+
nDXCount = 0;
if ( nDXCount )
pDXAry = new sal_Int32[ nDXCount ];
for ( i = 0; i < nDXCount; i++ )
