filter/source/graphicfilter/idxf/dxfentrd.cxx | 15 ++++++++++++--- filter/source/graphicfilter/idxf/dxfgrprd.cxx | 4 ++++ filter/source/graphicfilter/idxf/dxfgrprd.hxx | 1 + 3 files changed, 17 insertions(+), 3 deletions(-)
New commits: commit a304efedd2ca20f9ad29c18c996d00aadf30cf12 Author: Caolán McNamara <[email protected]> Date: Tue Jan 17 21:19:13 2017 +0000 ofz#414 crash in DXFHatchEntity::EvaluateGroup (cherry picked from commit 5434d51d12611eb2726ce1394eb01921d008fa89) ofz#415 crash in DXFVector::DXFVector (cherry picked from commit 2a9b4363ca190f1d783d540e95a031357f852858) Change-Id: I15c8cb7aeb8c45f32357afd0ea2f550ffe11dbf7 Reviewed-on: https://gerrit.libreoffice.org/33233 Reviewed-by: Michael Stahl <[email protected]> Tested-by: Michael Stahl <[email protected]> diff --git a/filter/source/graphicfilter/idxf/dxfentrd.cxx b/filter/source/graphicfilter/idxf/dxfentrd.cxx index 85508ac..d4f7e30 100644 --- a/filter/source/graphicfilter/idxf/dxfentrd.cxx +++ b/filter/source/graphicfilter/idxf/dxfentrd.cxx @@ -422,8 +422,11 @@ void DXFLWPolyLineEntity::EvaluateGroup( DXFGroupReader & rDGR ) case 90 : { nCount = rDGR.GetI(); - if ( nCount ) + // limit alloc to max reasonable size based on remaining data in stream + if (nCount > 0 && static_cast<sal_uInt32>(nCount) <= rDGR.remainingSize()) pP = new DXFVector[ nCount ]; + else + nCount = 0; } break; case 70: nFlags = rDGR.GetI(); break; @@ -600,8 +603,11 @@ bool DXFBoundaryPathData::EvaluateGroup( DXFGroupReader & rDGR ) case 93 : { nPointCount = rDGR.GetI(); - if ( nPointCount ) + // limit alloc to max reasonable size based on remaining data in stream + if (nPointCount > 0 && static_cast<sal_uInt32>(nPointCount) <= rDGR.remainingSize()) pP = new DXFVector[ nPointCount ]; + else + nPointCount = 0; } break; case 72 : nHasBulgeFlag = rDGR.GetI(); break; @@ -679,8 +685,11 @@ void DXFHatchEntity::EvaluateGroup( DXFGroupReader & rDGR ) { bIsInBoundaryPathContext = true; nBoundaryPathCount = rDGR.GetI(); - if ( nBoundaryPathCount ) + // limit alloc to max reasonable size based on remaining data in stream + if (nBoundaryPathCount > 0 && static_cast<sal_uInt32>(nBoundaryPathCount) <= rDGR.remainingSize()) pBoundaryPathData = new DXFBoundaryPathData[ nBoundaryPathCount ]; + else + nBoundaryPathCount = 0; } break; case 75 : diff --git a/filter/source/graphicfilter/idxf/dxfgrprd.cxx b/filter/source/graphicfilter/idxf/dxfgrprd.cxx index caa2c42..a6c02a4 100644 --- a/filter/source/graphicfilter/idxf/dxfgrprd.cxx +++ b/filter/source/graphicfilter/idxf/dxfgrprd.cxx @@ -217,5 +217,9 @@ void DXFGroupReader::ReadS() S = DXFReadLine(rIS); } +sal_uInt64 DXFGroupReader::remainingSize() const +{ + return rIS.remainingSize(); +} /* vim:set shiftwidth=4 softtabstop=4 expandtab: */ diff --git a/filter/source/graphicfilter/idxf/dxfgrprd.hxx b/filter/source/graphicfilter/idxf/dxfgrprd.hxx index c936b33..09bbcd3 100644 --- a/filter/source/graphicfilter/idxf/dxfgrprd.hxx +++ b/filter/source/graphicfilter/idxf/dxfgrprd.hxx @@ -59,6 +59,7 @@ public: // This read must have returned a group code for datatype String. // If not NULL is returend + sal_uInt64 remainingSize() const; private: long ReadI();
_______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
