This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/openoffice.git
The following commit(s) were added to refs/heads/trunk by this push:
new db81dcd785 Fix scratch buffer overflow in FreeBSD aarch64 bridge
Follow-up to stack alignment fix: guard against types larger than 8 bytes by
copying directly to stack instead of using scratch buffer.
db81dcd785 is described below
commit db81dcd785344765c11249e7639a5317cc58bb57
Author: Pedro Giffuni <[email protected]>
AuthorDate: Thu Oct 22 00:40:22 2026 -0500
Fix scratch buffer overflow in FreeBSD aarch64 bridge
Follow-up to stack alignment fix: guard against types larger than 8
bytes by copying directly to stack instead of using scratch buffer.
---
.../cpp_uno/gcc3_freebsd_aarch64/uno2cpp.cxx | 59 +++++++++++++---------
1 file changed, 34 insertions(+), 25 deletions(-)
diff --git a/main/bridges/source/cpp_uno/gcc3_freebsd_aarch64/uno2cpp.cxx
b/main/bridges/source/cpp_uno/gcc3_freebsd_aarch64/uno2cpp.cxx
index 30dbd72000..eb1a3cfe1b 100644
--- a/main/bridges/source/cpp_uno/gcc3_freebsd_aarch64/uno2cpp.cxx
+++ b/main/bridges/source/cpp_uno/gcc3_freebsd_aarch64/uno2cpp.cxx
@@ -362,46 +362,55 @@ static void cpp_call(
// (sal_uInt64) scratch slot; reuse them with a local
counter.
nStack = aarch64::align_stack_offset( nStack,
rParam.pTypeRef );
sal_uInt32 size = aarch64::stack_size( rParam.pTypeRef
);
- sal_uInt64 scratch[1] = {0};
- int tempNr = 0;
- switch (pParamTypeDescr->eTypeClass)
+ if ( size > 8 )
+ {
+ // Larger types are copied raw (no extension
needed).
+ memcpy( pStackStart + nStack, pCppArgs[nPos],
pParamTypeDescr->nSize );
+ nStack += size;
+ }
+ else
{
+ sal_uInt64 scratch[1] = {0};
+ int tempNr = 0;
+ switch (pParamTypeDescr->eTypeClass)
+ {
case typelib_TypeClass_FLOAT:
- INSERT_FLOAT( pCppArgs[nPos], tempNr,
reinterpret_cast<double *>(scratch) );
- break;
+ INSERT_FLOAT( pCppArgs[nPos], tempNr,
reinterpret_cast<double *>(scratch) );
+ break;
case typelib_TypeClass_DOUBLE:
- INSERT_DOUBLE( pCppArgs[nPos], tempNr,
reinterpret_cast<double *>(scratch) );
- break;
+ INSERT_DOUBLE( pCppArgs[nPos], tempNr,
reinterpret_cast<double *>(scratch) );
+ break;
case typelib_TypeClass_HYPER:
case typelib_TypeClass_UNSIGNED_HYPER:
- INSERT_INT64( pCppArgs[nPos], tempNr,
scratch );
- break;
+ INSERT_INT64( pCppArgs[nPos], tempNr,
scratch );
+ break;
case typelib_TypeClass_LONG:
- INSERT_SIGNED_INT32( pCppArgs[nPos],
tempNr, scratch );
- break;
+ INSERT_SIGNED_INT32( pCppArgs[nPos],
tempNr, scratch );
+ break;
case typelib_TypeClass_UNSIGNED_LONG:
case typelib_TypeClass_ENUM:
- INSERT_INT32( pCppArgs[nPos], tempNr,
scratch );
- break;
+ INSERT_INT32( pCppArgs[nPos], tempNr,
scratch );
+ break;
case typelib_TypeClass_SHORT:
- INSERT_SIGNED_INT16( pCppArgs[nPos],
tempNr, scratch );
- break;
+ INSERT_SIGNED_INT16( pCppArgs[nPos],
tempNr, scratch );
+ break;
case typelib_TypeClass_CHAR:
case typelib_TypeClass_UNSIGNED_SHORT:
- INSERT_INT16( pCppArgs[nPos], tempNr,
scratch );
- break;
+ INSERT_INT16( pCppArgs[nPos], tempNr,
scratch );
+ break;
case typelib_TypeClass_BYTE:
- INSERT_SIGNED_INT8( pCppArgs[nPos],
tempNr, scratch );
- break;
+ INSERT_SIGNED_INT8( pCppArgs[nPos], tempNr,
scratch );
+ break;
case typelib_TypeClass_BOOLEAN:
- INSERT_INT8( pCppArgs[nPos], tempNr,
scratch );
- break;
+ INSERT_INT8( pCppArgs[nPos], tempNr,
scratch );
+ break;
default:
- memcpy( scratch, pCppArgs[nPos],
pParamTypeDescr->nSize );
- break;
+ memcpy( scratch, pCppArgs[nPos],
pParamTypeDescr->nSize );
+ break;
+ }
+ memcpy( pStackStart + nStack, scratch, size );
+ nStack += size;
}
- memcpy( pStackStart + nStack, scratch, size );
- nStack += size;
}
TYPELIB_DANGER_RELEASE( pParamTypeDescr );
