lotuswordpro/source/filter/lwpgrfobj.cxx | 8 ++++++++ lotuswordpro/source/filter/lwpobjstrm.cxx | 6 ++++++ lotuswordpro/source/filter/lwpobjstrm.hxx | 1 + 3 files changed, 15 insertions(+)
New commits: commit b03bbb5203831bf77fb73bdb4cf19bdea29a1e1c Author: Caolán McNamara <[email protected]> Date: Fri Mar 10 10:21:41 2017 +0000 ofz#801 avoid oom Change-Id: Id3167d1eb3f058543ab7596008012d51b3d242b7 (cherry picked from commit 1353ebe535732022aef4377030d86ad7153c3144) Reviewed-on: https://gerrit.libreoffice.org/35037 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/lotuswordpro/source/filter/lwpgrfobj.cxx b/lotuswordpro/source/filter/lwpgrfobj.cxx index bf04563f8732..fd3240b28e77 100644 --- a/lotuswordpro/source/filter/lwpgrfobj.cxx +++ b/lotuswordpro/source/filter/lwpgrfobj.cxx @@ -111,6 +111,14 @@ void LwpGraphicObject::Read() unsigned char *pServerContext = nullptr; if (nServerContextSize > 0) { + sal_uInt16 nMaxPossibleSize = m_pObjStrm->remainingSize(); + + if (nServerContextSize > nMaxPossibleSize) + { + SAL_WARN("lwp", "stream too short for claimed no of records"); + nServerContextSize = nMaxPossibleSize; + } + pServerContext = new unsigned char[nServerContextSize]; m_pObjStrm->QuickRead(pServerContext, static_cast<sal_uInt16>(nServerContextSize)); if (nServerContextSize > 44) diff --git a/lotuswordpro/source/filter/lwpobjstrm.cxx b/lotuswordpro/source/filter/lwpobjstrm.cxx index 8675516ed549..16bc22934c04 100644 --- a/lotuswordpro/source/filter/lwpobjstrm.cxx +++ b/lotuswordpro/source/filter/lwpobjstrm.cxx @@ -162,6 +162,12 @@ void LwpObjectStream::ReleaseBuffer() } } } + +sal_uInt16 LwpObjectStream::remainingSize() const +{ + return m_nBufSize - m_nReadPos; +} + /** * @descr read len bytes from object stream to buffer */ diff --git a/lotuswordpro/source/filter/lwpobjstrm.hxx b/lotuswordpro/source/filter/lwpobjstrm.hxx index 826bd8e757b4..9650b29176b3 100644 --- a/lotuswordpro/source/filter/lwpobjstrm.hxx +++ b/lotuswordpro/source/filter/lwpobjstrm.hxx @@ -85,6 +85,7 @@ private: LwpSvStream* m_pStrm; bool m_bCompressed; public: + sal_uInt16 remainingSize() const; sal_uInt16 QuickRead(void* buf, sal_uInt16 len); sal_uInt16 GetPos() { return m_nReadPos; } void SeekRel(sal_uInt16 pos);
_______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
