[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source sd/qa
filter/source/msfilter/svdfppt.cxx |2 +-
sd/qa/unit/data/ppt/pass/crash-3.ppt |binary
2 files changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 0ae8d68a0b7c6d2be21b5e903114b0fe3de5a49c
Author: Caolán McNamara caol...@redhat.com
Date: Sun Aug 30 20:14:16 2015 +0100
pClientData can be null
Change-Id: I9375f84affdaef30d9b1ded31525e6b7b8709cbc
(cherry picked from commit 7d4c77e374310bef538465d11980d1d610cbe0f1)
Reviewed-on: https://gerrit.libreoffice.org/18150
Reviewed-by: Norbert Thiebaud nthieb...@gmail.com
Tested-by: Norbert Thiebaud nthieb...@gmail.com
diff --git a/filter/source/msfilter/svdfppt.cxx
b/filter/source/msfilter/svdfppt.cxx
index e1e14b8..73283e2 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -2576,7 +2576,7 @@ bool SdrPowerPointImport::GetColorFromPalette( sal_uInt16
nNum, Color rColor )
bool SdrPowerPointImport::SeekToShape( SvStream rSt, void* pClientData,
sal_uInt32 nId ) const
{
bool bRet = SvxMSDffManager::SeekToShape( rSt, pClientData, nId );
-if ( !bRet )
+if (!bRet pClientData)
{
ProcessData rData = *( (ProcessData*)pClientData );
PptSlidePersistEntry rPersistEntry = rData.rPersistEntry;
diff --git a/sd/qa/unit/data/ppt/pass/crash-3.ppt
b/sd/qa/unit/data/ppt/pass/crash-3.ppt
new file mode 100644
index 000..daa0102
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/crash-3.ppt differ
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source sd/qa sd/source
filter/source/msfilter/svdfppt.cxx | 62 ---
sd/qa/unit/data/ppt/pass/hang-15.ppt |binary
sd/qa/unit/data/ppt/pass/hang-16.ppt |binary
sd/qa/unit/data/ppt/pass/hang-17.ppt |binary
sd/source/filter/ppt/pptin.cxx | 29 +++-
sd/source/filter/ppt/propread.cxx| 21 ++-
6 files changed, 76 insertions(+), 36 deletions(-)
New commits:
commit b45df6e4037556c3ee6ccdb4497762884fdb2327
Author: Caolán McNamara caol...@redhat.com
Date: Fri Aug 28 08:28:51 2015 +0100
check seeks and reads
Change-Id: I0c5c4784713376e0762bfbd197640f8d31b65562
(cherry picked from commit 1847753ab135f522df6a293a8539155437f0129f)
Reviewed-on: https://gerrit.libreoffice.org/18116
Reviewed-by: David Tardon dtar...@redhat.com
Tested-by: David Tardon dtar...@redhat.com
diff --git a/filter/source/msfilter/svdfppt.cxx
b/filter/source/msfilter/svdfppt.cxx
index 40c3349..e1e14b8 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -782,7 +782,8 @@ SdrObject* SdrEscherImport::ProcessObj( SvStream rSt,
DffObjData rObjData, voi
}
break;
}
-aClientDataHd.SeekToEndOfRecord( rSt );
+if (!aClientDataHd.SeekToEndOfRecord(rSt))
+break;
}
}
if ( ( aPlaceholderAtom.nPlaceholderId ==
PPT_PLACEHOLDER_NOTESSLIDEIMAGE ) ( rPersistEntry.bNotesMaster == false ) )
@@ -1798,7 +1799,10 @@ SdrObject* SdrPowerPointImport::ImportOLE( long nOLEId,
break;
}
else
-aPlaceHd.SeekToEndOfRecord( rStCtrl );
+{
+if (!aPlaceHd.SeekToEndOfRecord(rStCtrl))
+break;
+}
}
}
@@ -2390,7 +2394,8 @@ bool SdrPowerPointImport::SeekToContentOfProgTag(
sal_Int32 nVersion, SvStream
}
}
}
-aProgTagBinaryDataHd.SeekToEndOfRecord( rSt );
+if (!aProgTagBinaryDataHd.SeekToEndOfRecord(rSt))
+break;
}
}
if ( !bRetValue )
@@ -2691,7 +2696,8 @@ void ImportComment10( SvxMSDffManager rMan, SvStream
rStCtrl, SdrPage* pPage,
}
break;
}
-aCommentHd.SeekToEndOfRecord( rStCtrl );
+if (!aCommentHd.SeekToEndOfRecord(rStCtrl))
+break;
}
Point aPosition( nPosX, nPosY );
rMan.Scale( aPosition );
@@ -2751,7 +2757,8 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet,
const PptSlidePersistEntry*
while( ( rStCtrl.GetError() == 0 ) SeekToRec(
rStCtrl, PPT_PST_Comment10, aContentDataHd.GetRecEndFilePos(), aComment10Hd ) )
{
ImportComment10( *this, rStCtrl, pRet,
aComment10Hd );
-aComment10Hd.SeekToEndOfRecord( rStCtrl );
+if (!aComment10Hd.SeekToEndOfRecord(rStCtrl))
+break;
}
}
}
@@ -2829,7 +2836,8 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet,
const PptSlidePersistEntry*
}
if ( aEscherObjListHd.nRecType ==
DFF_msofbtSpContainer )
break;
-aEscherObjListHd.SeekToEndOfRecord( rStCtrl );
+if (!aEscherObjListHd.SeekToEndOfRecord(rStCtrl))
+break;
}
// now importing page
@@ -2879,7 +2887,8 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet,
const PptSlidePersistEntry*
}
if ( aEscherObjListHd.nRecType ==
DFF_msofbtSpgrContainer )
break;
-aEscherObjListHd.SeekToEndOfRecord( rStCtrl );
+if (!aEscherObjListHd.SeekToEndOfRecord(rStCtrl))
+break;
}
if ( rSlidePersist.pBObj )
@@ -2895,7 +2904,8 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet,
const PptSlidePersistEntry*
}
break;
}
-aHd.SeekToEndOfRecord( rStCtrl );
+if (!aHd.SeekToEndOfRecord(rStCtrl))
+break;
}
if ( rSlidePersist.pSolverContainer )
SolveSolver( *rSlidePersist.pSolverContainer );
@@ -3115,7 +3125,8 @@ void SdrEscherImport::ImportHeaderFooterContainer(
DffRecordHeader rHd, HeaderF
}
break;
}
-aHd.SeekToEndOfRecord( rStCtrl );
+if (!aHd.SeekToEndOfRecord(rStCtrl))
+break;
}
}
@@ -3253,7 +3264,8 @@ PPTExtParaProv::PPTExtParaProv( SdrPowerPointImport
rMan, SvStream
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source sd/qa
filter/source/msfilter/msdffimp.cxx | 28 ++--
sd/qa/unit/data/ppt/pass/hang-19.ppt |binary
2 files changed, 14 insertions(+), 14 deletions(-)
New commits:
commit 15af8289d6fda5fe2c722faaf4f4e2371912133e
Author: Caolán McNamara caol...@redhat.com
Date: Fri Aug 28 15:33:44 2015 +0100
eof isn't a Error, so use good not GetError
Change-Id: Ie1df87c7eb9d391d0fa4a579f744051a1f1b2ae1
(cherry picked from commit 078235028a8c4ea36b6b366348016e19759c456a)
Reviewed-on: https://gerrit.libreoffice.org/18118
Reviewed-by: David Tardon dtar...@redhat.com
Tested-by: David Tardon dtar...@redhat.com
diff --git a/filter/source/msfilter/msdffimp.cxx
b/filter/source/msfilter/msdffimp.cxx
index 47a89e0..bab72e3 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -4147,17 +4147,17 @@ SdrObject* SvxMSDffManager::ImportShape( const
DffRecordHeader rHd, SvStream r
SEEK_FROM_BEGINNING ) )
{
sal_uInt32 nBytesLeft = maShapeRecords.Current()-nRecLen;
-sal_uInt32 nUDData;
-sal_uInt16 nPID;
while( 5 nBytesLeft )
{
-rSt.ReadUInt16( nPID );
-if ( rSt.GetError() != 0 )
+sal_uInt16 nPID(0);
+rSt.ReadUInt16(nPID);
+if (!rSt.good())
break;
-rSt.ReadUInt32( nUDData );
-if ( rSt.GetError() != 0 )
+sal_uInt32 nUDData(0);
+rSt.ReadUInt32(nUDData);
+if (!rSt.good())
break;
-if ( nPID == 447 )
+if (nPID == 447)
{
mbRotateGranientFillWithAngle = nUDData 0x20;
break;
@@ -4979,15 +4979,15 @@ SdrObject* SvxMSDffManager::ProcessObj(SvStream rSt,
maShapeRecords.Current()-nRecLen )
{
sal_uInt32 nBytesLeft = maShapeRecords.Current()-nRecLen;
-sal_uInt32 nUDData;
-sal_uInt16 nPID;
while( 5 nBytesLeft )
{
-rSt.ReadUInt16( nPID );
-if ( rSt.GetError() != 0 )
+sal_uInt16 nPID(0);
+rSt.ReadUInt16(nPID);
+if (!rSt.good())
break;
-rSt.ReadUInt32( nUDData );
-switch( nPID )
+sal_uInt32 nUDData(0);
+rSt.ReadUInt32(nUDData);
+switch (nPID)
{
case 0x038F: pImpRec-nXAlign = nUDData; break;
case 0x0390:
@@ -5017,7 +5017,7 @@ SdrObject* SvxMSDffManager::ProcessObj(SvStream rSt,
pImpRec-isHorizontalRule = true;
break;
}
-if ( rSt.GetError() != 0 )
+if (!rSt.good())
break;
nBytesLeft -= 6;
}
diff --git a/sd/qa/unit/data/ppt/pass/hang-19.ppt
b/sd/qa/unit/data/ppt/pass/hang-19.ppt
new file mode 100644
index 000..942a58a
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-19.ppt differ
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source
filter/source/graphicfilter/itiff/lzwdecom.cxx |8
1 file changed, 4 insertions(+), 4 deletions(-)
New commits:
commit 5e3b4e302afd36b382a1d177c434fcada21ed2d4
Author: Caolán McNamara caol...@redhat.com
Date: Thu Aug 27 14:40:37 2015 +0100
crashtesting: tiff loop detection too slow
moz323894-1.tiff and moz456356-1.tiff take too long to load
Change-Id: Iaafa064fd05e4a4152004e7ceb6256af68aeef01
(cherry picked from commit 7e373e92fc02393732422d05264dd5115076183f)
Reviewed-on: https://gerrit.libreoffice.org/18082
Reviewed-by: Michael Meeks michael.me...@collabora.com
Tested-by: Michael Meeks michael.me...@collabora.com
diff --git a/filter/source/graphicfilter/itiff/lzwdecom.cxx
b/filter/source/graphicfilter/itiff/lzwdecom.cxx
index 5fb7514..dc437e2 100644
--- a/filter/source/graphicfilter/itiff/lzwdecom.cxx
+++ b/filter/source/graphicfilter/itiff/lzwdecom.cxx
@@ -20,7 +20,7 @@
#include lzwdecom.hxx
#include algorithm
-#include vector
+#include set
#define MAX_TABLE_SIZE 4096
@@ -163,16 +163,16 @@ void LZWDecompressor::AddToTable(sal_uInt16 nPrevCode,
sal_uInt16 nCodeFirstData
return;
}
-std::vectorsal_uInt16 aSeenIndexes;
+unsigned char aSeenIndexes[MAX_TABLE_SIZE] = {0};
while (pTable[nCodeFirstData].nDataCount1)
{
-if (std::find(aSeenIndexes.begin(), aSeenIndexes.end(),
nCodeFirstData) != aSeenIndexes.end())
+if (aSeenIndexes[nCodeFirstData])
{
SAL_WARN(filter.tiff, Loop in chain);
bEOIFound = true;
return;
}
-aSeenIndexes.push_back(nCodeFirstData);
+aSeenIndexes[nCodeFirstData] = 1;
nCodeFirstData=pTable[nCodeFirstData].nPrevCode;
}
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source sd/qa sd/source
filter/source/msfilter/svdfppt.cxx | 22 +-
sd/qa/unit/data/ppt/pass/hang-9.ppt |binary
sd/source/filter/ppt/pptin.cxx |8 +++-
3 files changed, 24 insertions(+), 6 deletions(-)
New commits:
commit f6e85ec2eb9263e804098aeade75bd9fe8f39b27
Author: Caolán McNamara caol...@redhat.com
Date: Thu Aug 27 14:22:23 2015 +0100
avoid loops in atom chains
(cherry picked from commit de71eae5807ff94c8eace0eccaabf1ffa08e77b6)
Change-Id: Icc40c0ee6c7d8d305cf7cc60cbf3e511c763aedd
Reviewed-on: https://gerrit.libreoffice.org/18080
Reviewed-by: Michael Meeks michael.me...@collabora.com
Tested-by: Michael Meeks michael.me...@collabora.com
diff --git a/filter/source/msfilter/svdfppt.cxx
b/filter/source/msfilter/svdfppt.cxx
index 9a5ca61..b6693086 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -2541,11 +2541,17 @@ bool SdrPowerPointImport::GetColorFromPalette(
sal_uInt16 nNum, Color rColor )
while( ( pMasterPersist
pMasterPersist-aSlideAtom.nFlags 2 ) // it is possible that a masterpage
pMasterPersist-aSlideAtom.nMasterId )
// itself is following a master colorscheme
{
-sal_uInt16 nNextMaster = pMasterPages-FindPage(
pMasterPersist-aSlideAtom.nMasterId );
+auto nOrigMasterId =
pMasterPersist-aSlideAtom.nMasterId;
+sal_uInt16 nNextMaster =
pMasterPages-FindPage(nOrigMasterId);
if ( nNextMaster == PPTSLIDEPERSIST_ENTRY_NOTFOUND )
break;
else
pMasterPersist = (*pPageList2)[ nNextMaster ];
+if (pMasterPersist-aSlideAtom.nMasterId ==
nOrigMasterId)
+{
+SAL_WARN(filter.ms, loop in atom chain);
+break;
+}
}
}
if ( pMasterPersist )
@@ -2554,9 +2560,9 @@ bool SdrPowerPointImport::GetColorFromPalette( sal_uInt16
nNum, Color rColor )
}
}
}
-// resgister current color scheme
-((SdrPowerPointImport*)this)-nPageColorsNum = nAktPageNum;
-((SdrPowerPointImport*)this)-ePageColorsKind = eAktPageKind;
+// register current color scheme
+const_castSdrPowerPointImport*(this)-nPageColorsNum = nAktPageNum;
+const_castSdrPowerPointImport*(this)-ePageColorsKind = eAktPageKind;
}
rColor = aPageColors.GetColor( nNum );
return true;
@@ -2778,11 +2784,17 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet,
const PptSlidePersistEntry*
PptSlidePersistEntry* pE =
(*pPageList)[ nMasterNum ];
while( ( pE-aSlideAtom.nFlags 4
) pE-aSlideAtom.nMasterId )
{
-sal_uInt16 nNextMaster =
pMasterPages-FindPage( pE-aSlideAtom.nMasterId );
+auto nOrigMasterId =
pE-aSlideAtom.nMasterId;
+sal_uInt16 nNextMaster =
pMasterPages-FindPage(nOrigMasterId);
if ( nNextMaster ==
PPTSLIDEPERSIST_ENTRY_NOTFOUND )
break;
else
pE = (*pPageList)[
nNextMaster ];
+if (pE-aSlideAtom.nMasterId
== nOrigMasterId)
+{
+SAL_WARN(filter.ms,
loop in atom chain);
+break;
+}
}
if ( pE-nBackgroundOffset )
{
diff --git a/sd/qa/unit/data/ppt/pass/hang-9.ppt
b/sd/qa/unit/data/ppt/pass/hang-9.ppt
new file mode 100644
index 000..97e0158
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-9.ppt differ
diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx
index db2a05c..5fe2bdc 100644
--- a/sd/source/filter/ppt/pptin.cxx
+++ b/sd/source/filter/ppt/pptin.cxx
@@ -725,11 +725,17 @@ bool ImplSdPPTImport::Import()
PptSlidePersistEntry* pE = pPersist;
while( ( pE-aSlideAtom.nFlags 4 )
pE-aSlideAtom.nMasterId )
{
-sal_uInt16 nNextMaster = pMasterPages-FindPage(
pE-aSlideAtom.nMasterId );
+auto nOrigMasterId = pE-aSlideAtom.nMasterId;
+
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source include/filter sd/qa sd/source
filter/source/msfilter/svdfppt.cxx | 45 +++--
include/filter/msfilter/dffpropset.hxx |1
sd/qa/unit/data/ppt/pass/hang-3.ppt|binary
sd/source/filter/ppt/pptin.cxx | 35 +++--
4 files changed, 43 insertions(+), 38 deletions(-)
New commits:
commit 016ae98411175c123f0f20057fff9afee7b53359
Author: Caolán McNamara caol...@redhat.com
Date: Thu Aug 27 09:13:42 2015 +0100
extend seek, loop ending tests to ppt specific code
(cherry picked from commit c249f93d96ec87b0acbd25ffe087543d6fe9fb14)
Change-Id: Id4419b6b902b742117e248870b6a663c9c58955f
Reviewed-on: https://gerrit.libreoffice.org/18053
Reviewed-by: David Tardon dtar...@redhat.com
Tested-by: David Tardon dtar...@redhat.com
diff --git a/filter/source/msfilter/svdfppt.cxx
b/filter/source/msfilter/svdfppt.cxx
index 0942060..9a5ca61 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -706,19 +706,16 @@ void SdrEscherImport::RecolorGraphic( SvStream rSt,
sal_uInt32 nRecLen, Graphic
}
}
-namespace
+sal_uLong DffPropSet::SanitizeEndPos(SvStream rIn, sal_uLong nEndRecPos)
{
-sal_uLong SanitizeEndPos(SvStream rIn, sal_uLong nEndRecPos)
+auto nStreamLen = rIn.Tell() + rIn.remainingSize();
+if (nEndRecPos nStreamLen)
{
-auto nStreamLen = rIn.Tell() + rIn.remainingSize();
-if (nEndRecPos nStreamLen)
-{
-SAL_WARN(filter.ms, Parsing error: nStreamLen
- max end pos, but nEndRecPos claimed,
truncating);
-nEndRecPos = nStreamLen;
-}
-return nEndRecPos;
+SAL_WARN(filter.ms, Parsing error: nStreamLen
+ max end pos, but nEndRecPos claimed, truncating);
+nEndRecPos = nStreamLen;
}
+return nEndRecPos;
}
/* ProcessObject is called from ImplSdPPTImport::ProcessObj to handle all
application specific things,
@@ -2650,7 +2647,7 @@ void ImportComment10( SvxMSDffManager rMan, SvStream
rStCtrl, SdrPage* pPage,
sal_Int32 nPosY = 0;
-auto nEndRecPos = SanitizeEndPos(rStCtrl, rComment10Hd.GetRecEndFilePos());
+auto nEndRecPos = DffPropSet::SanitizeEndPos(rStCtrl,
rComment10Hd.GetRecEndFilePos());
while ( ( rStCtrl.GetError() == 0 ) ( rStCtrl.Tell() nEndRecPos ) )
{
DffRecordHeader aCommentHd;
@@ -3192,7 +3189,7 @@ PPTExtParaProv::PPTExtParaProv( SdrPowerPointImport
rMan, SvStream rSt, const
pListHd-SeekToContent( rSt );
if ( !rMan.SeekToContentOfProgTag( 9, rSt, *pListHd, aContentDataHd ) )
break;
-auto nEndRecPos = SanitizeEndPos(rSt,
aContentDataHd.GetRecEndFilePos());
+auto nEndRecPos = DffPropSet::SanitizeEndPos(rSt,
aContentDataHd.GetRecEndFilePos());
while ( ( rSt.GetError() == 0 ) ( rSt.Tell() nEndRecPos ) )
{
ReadDffRecordHeader( rSt, aHd );
@@ -3200,7 +3197,7 @@ PPTExtParaProv::PPTExtParaProv( SdrPowerPointImport
rMan, SvStream rSt, const
{
case PPT_PST_ExtendedBuGraContainer :
{
-auto nHdEndRecPos = SanitizeEndPos(rSt,
aHd.GetRecEndFilePos());
+auto nHdEndRecPos = DffPropSet::SanitizeEndPos(rSt,
aHd.GetRecEndFilePos());
while ( ( rSt.GetError() == 0 ) ( rSt.Tell()
nHdEndRecPos ) )
{
sal_uInt16 nType;
@@ -3275,7 +3272,7 @@ PPTExtParaProv::PPTExtParaProv( SdrPowerPointImport
rMan, SvStream rSt, const
{ // get the extended paragraph styles on mainmaster ( graphical
bullets, num ruling ... )
if ( !rMan.SeekToContentOfProgTag( 9, rSt, *pHd, aContentDataHd ) )
break;
-auto nEndRecPos = SanitizeEndPos(rSt,
aContentDataHd.GetRecEndFilePos());
+auto nEndRecPos = DffPropSet::SanitizeEndPos(rSt,
aContentDataHd.GetRecEndFilePos());
while ( ( rSt.GetError() == 0 ) ( rSt.Tell() nEndRecPos ) )
{
ReadDffRecordHeader( rSt, aHd );
@@ -3289,7 +3286,7 @@ PPTExtParaProv::PPTExtParaProv( SdrPowerPointImport
rMan, SvStream rSt, const
rSt.ReadUInt16( nDepth );
if ( i = 5 )
{
-auto nHdEndRecPos = SanitizeEndPos(rSt,
aHd.GetRecEndFilePos());
+auto nHdEndRecPos =
DffPropSet::SanitizeEndPos(rSt, aHd.GetRecEndFilePos());
while ( ( rSt.GetError() == 0 ) ( rSt.Tell()
nHdEndRecPos ) ( i nDepth ) )
{
bStyles = true;
@@ -4052,7 +4049,7 @@ PPTStyleSheet::PPTStyleSheet( const DffRecordHeader
rSlideHd, SvStream rIn, Sd
{
pEnvHeader-SeekToContent( rIn );
DffRecordHeader aTxMasterStyleHd;
-auto nEndRecPos = SanitizeEndPos(rIn, pEnvHeader-GetRecEndFilePos());
+auto
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source sd/qa sd/source
filter/source/msfilter/svdfppt.cxx | 112 ++--
sd/qa/unit/data/ppt/pass/hang-2.ppt |binary
sd/source/filter/ppt/propread.cxx |6 +
3 files changed, 74 insertions(+), 44 deletions(-)
New commits:
commit 1bb226646e4d3b6ee3b25511e3c9c79373874359
Author: Caolán McNamara caol...@redhat.com
Date: Wed Aug 26 14:26:40 2015 +0100
various hangs, check seeks and record lengths
(cherry picked from commit a8b2dc80c41022515c3a1df6f7ea245c3390dc39)
Change-Id: Ided7f9376f41ee8cb1f6903e54a2d51e0e07e1a7
Reviewed-on: https://gerrit.libreoffice.org/18026
Reviewed-by: David Tardon dtar...@redhat.com
Tested-by: David Tardon dtar...@redhat.com
diff --git a/filter/source/msfilter/svdfppt.cxx
b/filter/source/msfilter/svdfppt.cxx
index fb6d3a6..0942060 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -706,6 +706,21 @@ void SdrEscherImport::RecolorGraphic( SvStream rSt,
sal_uInt32 nRecLen, Graphic
}
}
+namespace
+{
+sal_uLong SanitizeEndPos(SvStream rIn, sal_uLong nEndRecPos)
+{
+auto nStreamLen = rIn.Tell() + rIn.remainingSize();
+if (nEndRecPos nStreamLen)
+{
+SAL_WARN(filter.ms, Parsing error: nStreamLen
+ max end pos, but nEndRecPos claimed,
truncating);
+nEndRecPos = nStreamLen;
+}
+return nEndRecPos;
+}
+}
+
/* ProcessObject is called from ImplSdPPTImport::ProcessObj to handle all
application specific things,
such as the import of text, animation effects, header footer and
placeholder.
@@ -731,7 +746,8 @@ SdrObject* SdrEscherImport::ProcessObj( SvStream rSt,
DffObjData rObjData, voi
{
sal_Int16 nHeaderFooterInstance = -1;
DffRecordHeader aClientDataHd;
-while ( ( rSt.GetError() == 0 ) ( rSt.Tell()
maShapeRecords.Current()-GetRecEndFilePos() ) )
+auto nEndRecPos = SanitizeEndPos(rSt,
maShapeRecords.Current()-GetRecEndFilePos());
+while ( ( rSt.GetError() == 0 ) ( rSt.Tell() nEndRecPos ) )
{
ReadDffRecordHeader( rSt, aClientDataHd );
switch ( aClientDataHd.nRecType )
@@ -1342,9 +1358,8 @@ SdrPowerPointImport::SdrPowerPointImport(
PowerPointImportParam rParam, const O
while( nCurrentEditAtomStrmPos )
{
sal_uInt32 nPersistIncPos =
aCurrentEditAtom.nOffsetPersistDirectory;
-if ( nPersistIncPos )
+if (nPersistIncPos rStCtrl.Seek(nPersistIncPos) ==
nPersistIncPos)
{
-rStCtrl.Seek( nPersistIncPos );
DffRecordHeader aPersistHd;
ReadDffRecordHeader( rStCtrl, aPersistHd );
if ( aPersistHd.nRecType ==
PPT_PST_PersistPtrIncrementalBlock )
@@ -1774,8 +1789,10 @@ SdrObject* SdrPowerPointImport::ImportOLE( long nOLEId,
if ( ((SdrPowerPointImport*)this)-maShapeRecords.SeekToContent( rStCtrl,
DFF_msofbtClientData, SEEK_FROM_CURRENT_AND_RESTART ) )
{
DffRecordHeader aPlaceHd;
+
+auto nEndRecPos = SanitizeEndPos(rStCtrl,
const_castSdrPowerPointImport*(this)-maShapeRecords.Current()-GetRecEndFilePos());
while ( ( rStCtrl.GetError() == 0 )
- ( rStCtrl.Tell()
((SdrPowerPointImport*)this)-maShapeRecords.Current()-GetRecEndFilePos() ) )
+ ( rStCtrl.Tell() nEndRecPos ) )
{
ReadDffRecordHeader( rStCtrl, aPlaceHd );
if ( aPlaceHd.nRecType == PPT_PST_RecolorInfoAtom )
@@ -2632,7 +2649,9 @@ void ImportComment10( SvxMSDffManager rMan, SvStream
rStCtrl, SdrPage* pPage,
sal_Int32 nPosX = 0;
sal_Int32 nPosY = 0;
-while ( ( rStCtrl.GetError() == 0 ) ( rStCtrl.Tell()
rComment10Hd.GetRecEndFilePos() ) )
+
+auto nEndRecPos = SanitizeEndPos(rStCtrl, rComment10Hd.GetRecEndFilePos());
+while ( ( rStCtrl.GetError() == 0 ) ( rStCtrl.Tell() nEndRecPos ) )
{
DffRecordHeader aCommentHd;
ReadDffRecordHeader( rStCtrl, aCommentHd );
@@ -2707,7 +2726,8 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet,
const PptSlidePersistEntry*
{
rSlidePersist.pHeaderFooterEntry = new HeaderFooterEntry(
pMasterPersist );
ProcessData aProcessData( rSlidePersist, (SdPage*)pRet );
-while ( ( rStCtrl.GetError() == 0 ) ( rStCtrl.Tell()
aPageHd.GetRecEndFilePos() ) )
+auto nEndRecPos = SanitizeEndPos(rStCtrl, aPageHd.GetRecEndFilePos());
+while ( ( rStCtrl.GetError() == 0 ) ( rStCtrl.Tell() nEndRecPos )
)
{
DffRecordHeader aHd;
ReadDffRecordHeader( rStCtrl, aHd );
@@ -2742,7 +2762,8 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet,
const PptSlidePersistEntry*
sal_uInt32 nPPDrawOfs = rStCtrl.Tell();
// importing the background object
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source sd/qa sd/source
filter/source/msfilter/svdfppt.cxx | 14 --
sd/qa/unit/data/ppt/pass/hang-1.ppt |binary
sd/source/filter/ppt/pptin.cxx |7 ++-
3 files changed, 18 insertions(+), 3 deletions(-)
New commits:
commit 17795660145a30c6ccf1dd95c16726c60e50619a
Author: Caolán McNamara caol...@redhat.com
Date: Wed Aug 26 12:35:01 2015 +0100
don't hang on unreachable record ends
Change-Id: I288f7ff0327831603eda6e827c8acbae678dfaff
(cherry picked from commit cadac8400a018c8c566379f7767ea5edff78523d)
Reviewed-on: https://gerrit.libreoffice.org/18021
Reviewed-by: David Tardon dtar...@redhat.com
Tested-by: David Tardon dtar...@redhat.com
diff --git a/filter/source/msfilter/svdfppt.cxx
b/filter/source/msfilter/svdfppt.cxx
index 94185f1..fb6d3a6 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -4072,8 +4072,18 @@ PPTStyleSheet::PPTStyleSheet( const DffRecordHeader
rSlideHd, SvStream rIn, Sd
}
rSlideHd.SeekToContent( rIn );
+
+auto nEndRecPos = rSlideHd.GetRecEndFilePos();
+auto nStreamLen = rIn.Tell() + rIn.remainingSize();
+if (nEndRecPos nStreamLen)
+{
+SAL_WARN(filter.ms, Parsing error: nStreamLen
+ max end pos, but nEndRecPos claimed, truncating);
+nEndRecPos = nStreamLen;
+}
+
DffRecordHeader aTxMasterStyleHd;
-while ( rIn.Tell() rSlideHd.GetRecEndFilePos() )
+while (rIn.Tell() nEndRecPos)
{
ReadDffRecordHeader( rIn, aTxMasterStyleHd );
if ( aTxMasterStyleHd.nRecType == PPT_PST_TxMasterStyleAtom )
@@ -4081,7 +4091,7 @@ PPTStyleSheet::PPTStyleSheet( const DffRecordHeader
rSlideHd, SvStream rIn, Sd
else
aTxMasterStyleHd.SeekToEndOfRecord( rIn );
}
-while ( ( aTxMasterStyleHd.nRecType == PPT_PST_TxMasterStyleAtom ) (
rIn.Tell() rSlideHd.GetRecEndFilePos() ) ) //TODO: aTxMasterStyleHd may be
used without having been properly initialized
+while ( ( aTxMasterStyleHd.nRecType == PPT_PST_TxMasterStyleAtom ) (
rIn.Tell() nEndRecPos ) ) //TODO: aTxMasterStyleHd may be used without having
been properly initialized
{
sal_uInt32 nInstance = aTxMasterStyleHd.nRecInstance;
if ( ( nInstance PPT_STYLESHEETENTRYS )
diff --git a/sd/qa/unit/data/ppt/pass/hang-1.ppt
b/sd/qa/unit/data/ppt/pass/hang-1.ppt
new file mode 100644
index 000..d30cb84
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-1.ppt differ
diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx
index 64c64ba..06a89e6 100644
--- a/sd/source/filter/ppt/pptin.cxx
+++ b/sd/source/filter/ppt/pptin.cxx
@@ -813,7 +813,12 @@ bool ImplSdPPTImport::Import()
}
break;
}
-aHd.SeekToEndOfRecord( rStCtrl );
+bool bSuccess = aHd.SeekToEndOfRecord(rStCtrl);
+if (!bSuccess)
+{
+SAL_WARN(filter.ms, Count not seek to end of
record);
+break;
+}
}
}
rStCtrl.Seek( nFPosMerk );
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source include/filter sd/qa
filter/source/msfilter/svdfppt.cxx |6 +++---
include/filter/msfilter/svdfppt.hxx | 12 +++-
sd/qa/unit/data/ppt/pass/crash-1.ppt |binary
3 files changed, 10 insertions(+), 8 deletions(-)
New commits:
commit d88af143b70bae47c8f47939f17a593f20bd06b8
Author: Caolán McNamara caol...@redhat.com
Date: Wed Aug 26 11:25:03 2015 +0100
fix crash on loading certain ppts
Change-Id: I544a67e3706c7d12414cc075118ef2f0f5ddd0f6
(cherry picked from commit 334dba623dfb0c4fb2b5292c2d03741b7b33aef1)
Reviewed-on: https://gerrit.libreoffice.org/18020
Reviewed-by: David Tardon dtar...@redhat.com
Tested-by: David Tardon dtar...@redhat.com
diff --git a/filter/source/msfilter/svdfppt.cxx
b/filter/source/msfilter/svdfppt.cxx
index d0b2103..94185f1 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -4030,13 +4030,13 @@ PPTStyleSheet::PPTStyleSheet( const DffRecordHeader
rSlideHd, SvStream rIn, Sd
ReadDffRecordHeader( rIn, aTxMasterStyleHd );
if ( aTxMasterStyleHd.nRecType == PPT_PST_TxMasterStyleAtom )
{
-sal_uInt16 nLevelAnz;
-rIn.ReadUInt16( nLevelAnz );
+sal_uInt16 nLevelAnz(0);
+rIn.ReadUInt16(nLevelAnz);
sal_uInt16 nLev = 0;
bool bFirst = true;
bFoundTxMasterStyleAtom04 = true;
-while ( rIn.GetError() == 0 rIn.Tell()
aTxMasterStyleHd.GetRecEndFilePos() nLev nLevelAnz )
+while (rIn.GetError() == 0 rIn.Tell()
aTxMasterStyleHd.GetRecEndFilePos() nLev nLevelAnz nLev nMaxPPTLevels)
{
if ( nLev )
{
diff --git a/include/filter/msfilter/svdfppt.hxx
b/include/filter/msfilter/svdfppt.hxx
index 6bbe818..cb99d22 100644
--- a/include/filter/msfilter/svdfppt.hxx
+++ b/include/filter/msfilter/svdfppt.hxx
@@ -166,6 +166,8 @@ const sal_uInt32 PPTInventor = sal_uInt32('P') * 0x0001
+ sal_uInt32('T') * 0x0001
+ sal_uInt32('0') * 0x0100;
+const int nMaxPPTLevels = 5;
+
// Object IDs for StarDraw UserData
#define PPT_OBJECTINFO_ID (1)
@@ -715,7 +717,7 @@ struct PPTExtParaLevel
struct PPTExtParaSheet
{
-PPTExtParaLevel aExtParaLevel[ 5 ];
+PPTExtParaLevel aExtParaLevel[nMaxPPTLevels];
};
struct PPTBuGraEntry
@@ -762,7 +764,7 @@ struct PPTCharLevel
struct PPTCharSheet
{
-PPTCharLevelmaCharLevel[ 5 ];
+PPTCharLevelmaCharLevel[nMaxPPTLevels];
explicit PPTCharSheet( sal_uInt32 nInstance );
PPTCharSheet( const PPTCharSheet rCharSheet );
@@ -795,7 +797,7 @@ struct PPTParaSheet
{
public:
-PPTParaLevelmaParaLevel[ 5 ];
+PPTParaLevelmaParaLevel[nMaxPPTLevels];
explicit PPTParaSheet( sal_uInt32 nInstance );
PPTParaSheet( const PPTParaSheet rParaSheet );
@@ -1000,8 +1002,8 @@ struct PPTRuler
sal_Int32 nFlags;
sal_uInt16 nDefaultTab;
-sal_uInt16 nTextOfs[ 5 ];
-sal_uInt16 nBulletOfs[ 5 ];
+sal_uInt16 nTextOfs[nMaxPPTLevels];
+sal_uInt16 nBulletOfs[nMaxPPTLevels];
PPTTabEntry*pTab;
sal_uInt16 nTabCount;
diff --git a/sd/qa/unit/data/ppt/pass/crash-1.ppt
b/sd/qa/unit/data/ppt/pass/crash-1.ppt
new file mode 100644
index 000..5d1a04b
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/crash-1.ppt differ
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source
filter/source/graphicfilter/ipbm/ipbm.cxx | 24
1 file changed, 24 insertions(+)
New commits:
commit 0382dd6b26a77484cc2818ea1655da373fa92e5f
Author: Stephan Bergmann sberg...@redhat.com
Date: Tue Aug 25 11:58:42 2015 +0200
Avoid overflow in PBMReader::ImplReadHeader
...as found by UBSan in CppunitTest_filter_ppm_test on
filter/qa/cppunit/data/pbm/fail/crash-1.pbm
Change-Id: Ib7c50ef1f07aba6b78f79c608be69c3dac38ddfe
(cherry picked from commit 662498ab80833a2b671c247fb859603632e52105)
Reviewed-on: https://gerrit.libreoffice.org/17989
Reviewed-by: Caolán McNamara caol...@redhat.com
Tested-by: Caolán McNamara caol...@redhat.com
diff --git a/filter/source/graphicfilter/ipbm/ipbm.cxx
b/filter/source/graphicfilter/ipbm/ipbm.cxx
index 231b0e6..89ac09d 100644
--- a/filter/source/graphicfilter/ipbm/ipbm.cxx
+++ b/filter/source/graphicfilter/ipbm/ipbm.cxx
@@ -234,17 +234,41 @@ bool PBMReader::ImplReadHeader()
nDat -= '0';
if ( nCount == 0 )
{
+if (mnWidth SAL_MAX_INT32 / 10)
+{
+return false;
+}
mnWidth *= 10;
+if (nDat SAL_MAX_INT32 - mnWidth)
+{
+return false;
+}
mnWidth += nDat;
}
else if ( nCount == 1 )
{
+if (mnHeight SAL_MAX_INT32 / 10)
+{
+return false;
+}
mnHeight *= 10;
+if (nDat SAL_MAX_INT32 - mnHeight)
+{
+return false;
+}
mnHeight += nDat;
}
else if ( nCount == 2 )
{
+if (mnMaxVal std::numeric_limitssal_uLong::max() / 10)
+{
+return false;
+}
mnMaxVal *= 10;
+if (nDat std::numeric_limitssal_uLong::max() - mnMaxVal)
+{
+return false;
+}
mnMaxVal += nDat;
}
}
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source
filter/source/svg/svgwriter.cxx | 31 ---
1 file changed, 16 insertions(+), 15 deletions(-)
New commits:
commit cefea9d05085bfc0e485fae5d927544a9e07739c
Author: Chr. Rossmanith chrrossman...@gmx.de
Date: Tue Feb 3 22:29:31 2015 +0100
tdf#65788: svg export - put transform attribute into text element
if transform is put into an inner tspan element rotated text isn't rendered
rotated
Reviewed-on: https://gerrit.libreoffice.org/14314
Reviewed-by: Katarina Behrens bu...@bubli.org
Tested-by: Katarina Behrens bu...@bubli.org
(cherry picked from commit cacc3a0e7f7b04240daf63b45e457428388f4929)
Change-Id: I6fcab1db0e213c65fe8ba88a7694fd10c902bfec
Reviewed-on: https://gerrit.libreoffice.org/15994
Tested-by: David Tardon dtar...@redhat.com
Reviewed-by: David Tardon dtar...@redhat.com
diff --git a/filter/source/svg/svgwriter.cxx b/filter/source/svg/svgwriter.cxx
index 89ae3e3..a63210d 100644
--- a/filter/source/svg/svgwriter.cxx
+++ b/filter/source/svg/svgwriter.cxx
@@ -1157,6 +1157,22 @@ void SVGTextWriter::startTextShape()
mbIsTextShapeStarted = true;
maParentFont = vcl::Font();
mrExport.AddAttribute( XML_NAMESPACE_NONE, class, TextShape );
+
+// if text is rotated, set transform matrix at text element
+const vcl::Font rFont = mpVDev-GetFont();
+if( rFont.GetOrientation() )
+{
+Point aRot( maTextPos );
+OUString aTransform =
+translate( + OUString::number( aRot.X() ) +
+, + OUString::number( aRot.Y() ) + ) rotate( +
+OUString::number( rFont.GetOrientation() * -0.1 ) +
+) translate( + OUString::number( -aRot.X() ) +
+, + OUString::number( -aRot.Y() ) + );
+
+mrExport.AddAttribute( XML_NAMESPACE_NONE, aXMLAttrTransform,
aTransform );
+}
+
mpTextShapeElem = new SvXMLElementExport( mrExport,
XML_NAMESPACE_NONE, aXMLElemText, true, mbIWS );
startTextParagraph();
}
@@ -1245,21 +1261,6 @@ void SVGTextWriter::startTextPosition( bool bExportX,
bool bExportY )
if( bExportY )
mrExport.AddAttribute( XML_NAMESPACE_NONE, aXMLAttrY,
OUString::number( maTextPos.Y() ) );
-// if text is rotated, set transform matrix at new tspan element
-const vcl::Font rFont = mpVDev-GetFont();
-if( rFont.GetOrientation() )
-{
-Point aRot( maTextPos );
-OUString aTransform =
-OUString(translate() + OUString::number( aRot.X() ) +
-, + OUString::number( aRot.Y() ) + ) rotate( +
-OUString::number( rFont.GetOrientation() * -0.1 ) +
-) translate( + OUString::number( -aRot.X() ) +
-, + OUString::number( -aRot.Y() ) + );
-
-mrExport.AddAttribute( XML_NAMESPACE_NONE, aXMLAttrTransform,
aTransform );
-}
-
mpTextPositionElem = new SvXMLElementExport( mrExport, XML_NAMESPACE_NONE,
aXMLElemTspan, mbIWS, mbIWS );
}
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source
filter/source/xslt/import/spreadsheetml/spreadsheetml2ooo.xsl | 13 --
1 file changed, 6 insertions(+), 7 deletions(-)
New commits:
commit 26c6602c9036e12e0d228b6f5377f47fde5a530f
Author: Robert Antoni Buj Gelonch robert@gmail.com
Date: Wed May 20 23:31:46 2015 +0200
tdf#90999: Import spreadsheetML cells with inline formatting tags
Change-Id: Icb906a7944097d2cc92addc0e85be08f089a23e4
Reviewed-on: https://gerrit.libreoffice.org/15833
Reviewed-by: Adolfo Jayme Barrientos fit...@ubuntu.com
Tested-by: Adolfo Jayme Barrientos fit...@ubuntu.com
diff --git a/filter/source/xslt/import/spreadsheetml/spreadsheetml2ooo.xsl
b/filter/source/xslt/import/spreadsheetml/spreadsheetml2ooo.xsl
index a5875c2..09d1270 100644
--- a/filter/source/xslt/import/spreadsheetml/spreadsheetml2ooo.xsl
+++ b/filter/source/xslt/import/spreadsheetml/spreadsheetml2ooo.xsl
@@ -479,7 +479,7 @@
xsl:apply-templates
select=/ss:Workbook/ss:Styles/ss:Style[not(@ss:Name)]/
xsl:apply-templates
select=/ss:Workbook/ss:Styles/ss:Style/ss:Font[@ss:VerticalAlign]/
!-- applying to ss:Data (but *, as also ss:Data nested
in ss:Comments --
- xsl:apply-templates
select=/ss:Workbook/ss:Worksheet/ss:Table/ss:Row/ss:Cell/*[descendant-or-self::*[namespace-uri()='http://www.w3.org/TR/REC-html40']]/
+ xsl:apply-templates
select=/ss:Workbook/ss:Worksheet/ss:Table/ss:Row/ss:Cell/*[descendant-or-self::*]/
xsl:apply-templates
select=/ss:Workbook/ss:Worksheet/x:WorksheetOptions/x:PageSetup//@x:Data/
!-- if ConditionalFormatting exists,transforing the
styles --
xsl:if
test=/ss:Workbook/ss:Worksheet/x:ConditionalFormatting
@@ -6920,13 +6920,12 @@
/xsl:template
xsl:template name=create-data-content
xsl:param name=style-id select=@ss:StyleID/
- !-- collect every HTML 3.2 children, which are not empty --
- xsl:variable name=html-children
select=ss:Data/descendant-or-self::*[namespace-uri()='http://www.w3.org/TR/REC-html40'][string-length(text())
!= 0]/
xsl:choose
- xsl:when test=$html-children and $html-children !=
''
- xsl:for-each select=$html-children
+ xsl:when test=ss:Data//text()[string-length(.) != 0]
+ xsl:for-each
select=ss:Data//text()[string-length(.) != 0]
+ xsl:sort select=position( )
order=ascending data-type=number/
text:span
text:style-name={concat($style-id, 'T',
count(preceding::ss:Data[child::html:*]), '_', position())}
- xsl:copy-of select=text()/
+ xsl:value-of select=./
/text:span
/xsl:for-each
/xsl:when
@@ -7170,7 +7169,7 @@
/xsl:if
/xsl:template
xsl:template match=ss:Data
- xsl:for-each
select=descendant-or-self::*[namespace-uri()='http://www.w3.org/TR/REC-html40'][string-length(text())
!= 0]
+ xsl:for-each select=.//text()[string-length(.) != 0]
style:style
style:name={concat(ancestor::ss:Cell/@ss:StyleID,'T',count(preceding::ss:Data[child::html:*]),
'_', position())} style:family=text
xsl:element name=style:text-properties
xsl:if
test=ancestor-or-self::html:Font/@html:Face
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source
filter/source/msfilter/escherex.cxx | 37 ++--
1 file changed, 19 insertions(+), 18 deletions(-)
New commits:
commit 78ca28fb175f8b08b83b40050e41fe30f1bf6237
Author: Caolán McNamara caol...@redhat.com
Date: Mon Apr 13 12:46:34 2015 +0100
Related: tdf#74018 fix int wraparound + crash on export
of fdo74018-2.docx to doc
nPoints is 16bit and accumulated value wraps around, so use
a 32bit nTotalPoints instead and move 16bit declarations to
use points to confirm no other wraparounds
(cherry picked from commit ce705ac56a8709970356d634abb964adef105594)
Change-Id: If97ccb46ed8eb7f4305cdfe328ae83bc2b0c778c
Reviewed-on: https://gerrit.libreoffice.org/15280
Tested-by: Christian Lohmaier lohmaier+libreoff...@googlemail.com
Reviewed-by: Christian Lohmaier lohmaier+libreoff...@googlemail.com
diff --git a/filter/source/msfilter/escherex.cxx
b/filter/source/msfilter/escherex.cxx
index 23fcc48..517b548 100644
--- a/filter/source/msfilter/escherex.cxx
+++ b/filter/source/msfilter/escherex.cxx
@@ -2056,42 +2056,43 @@ bool EscherPropertyContainer::CreatePolygonProperties(
{
Polygon aPolygon;
-sal_uInt16 i, j, k, nPoints, nBezPoints, nPolyCount =
aPolyPolygon.Count();
+sal_uInt16 nPolyCount = aPolyPolygon.Count();
+sal_uInt32 nTotalPoints(0), nTotalBezPoints(0);
Rectangle aRect( aPolyPolygon.GetBoundRect() );
rGeoRect = ::com::sun::star::awt::Rectangle( aRect.Left(),
aRect.Top(), aRect.GetWidth(), aRect.GetHeight() );
-for ( nBezPoints = nPoints = i = 0; i nPolyCount; i++ )
+for (sal_uInt16 i = 0; i nPolyCount; ++i)
{
-k = aPolyPolygon[ i ].GetSize();
-nPoints = nPoints + k;
-for ( j = 0; j k; j++ )
+sal_uInt16 k = aPolyPolygon[ i ].GetSize();
+nTotalPoints += k;
+for (sal_uInt16 j = 0; j k; ++j)
{
if ( aPolyPolygon[ i ].GetFlags( j ) != POLY_CONTROL )
-nBezPoints++;
+nTotalBezPoints++;
}
}
-sal_uInt32 nVerticesBufSize = ( nPoints 2 ) + 6;
+sal_uInt32 nVerticesBufSize = ( nTotalPoints 2 ) + 6;
sal_uInt8* pVerticesBuf = new sal_uInt8[ nVerticesBufSize ];
-sal_uInt32 nSegmentBufSize = ( ( nBezPoints 2 ) + 8 );
+sal_uInt32 nSegmentBufSize = ( ( nTotalBezPoints 2 ) + 8 );
if ( nPolyCount 1 )
nSegmentBufSize += ( nPolyCount 1 );
sal_uInt8* pSegmentBuf = new sal_uInt8[ nSegmentBufSize ];
sal_uInt8* pPtr = pVerticesBuf;
-*pPtr++ = (sal_uInt8)( nPoints );// Little
endian
-*pPtr++ = (sal_uInt8)( nPoints 8 );
-*pPtr++ = (sal_uInt8)( nPoints );
-*pPtr++ = (sal_uInt8)( nPoints 8 );
+*pPtr++ = (sal_uInt8)( nTotalPoints );//
Little endian
+*pPtr++ = (sal_uInt8)( nTotalPoints 8 );
+*pPtr++ = (sal_uInt8)( nTotalPoints );
+*pPtr++ = (sal_uInt8)( nTotalPoints 8 );
*pPtr++ = (sal_uInt8)0xf0;
*pPtr++ = (sal_uInt8)0xff;
-for ( j = 0; j nPolyCount; j++ )
+for (sal_uInt16 j = 0; j nPolyCount; ++j)
{
aPolygon = aPolyPolygon[ j ];
-nPoints = aPolygon.GetSize();
-for ( i = 0; i nPoints; i++ ) // write points
from polygon to buffer
+sal_uInt16 nPoints = aPolygon.GetSize();
+for (sal_uInt16 i = 0; i nPoints; ++i) // write
points from polygon to buffer
{
Point aPoint = aPolygon[ i ];
aPoint.X() -= rGeoRect.X;
@@ -2112,13 +2113,13 @@ bool EscherPropertyContainer::CreatePolygonProperties(
*pPtr++ = (sal_uInt8)2;
*pPtr++ = (sal_uInt8)0;
-for ( j = 0; j nPolyCount; j++ )
+for (sal_uInt16 j = 0; j nPolyCount; ++j)
{
*pPtr++ = 0x0; // Polygon start
*pPtr++ = 0x40;
aPolygon = aPolyPolygon[ j ];
-nPoints = aPolygon.GetSize();
-for ( i = 0; i nPoints; i++ ) // write Polyflags to
Buffer
+sal_uInt16 nPoints = aPolygon.GetSize();
+for (sal_uInt16 i = 0; i nPoints; ++i) // write
Polyflags to Buffer
{
*pPtr++ = 0;
if ( bBezier )
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source
filter/source/svg/svgexport.cxx |5 +
1 file changed, 1 insertion(+), 4 deletions(-)
New commits:
commit 4542e5bd0a9b3838794c72becd1f7caa41846c07
Author: Chr. Rossmanith chrrossman...@gmx.de
Date: Sat Apr 4 20:55:29 2015 +0200
tdf#56467 / tdf#88117: SVG export further improved
omitting the clip-path from the svg element and keeping it only in
the slides enables rendering of exported selection in viewers like
firefox and inkscape
Change-Id: If296a78a3f948728e8b2ec257849be129bec5d92
Reviewed-on: https://gerrit.libreoffice.org/15155
Tested-by: Jenkins c...@libreoffice.org
Reviewed-by: Thorsten Behrens thorsten.behr...@cib.de
Reviewed-on: https://gerrit.libreoffice.org/15312
Tested-by: Norbert Thiebaud nthieb...@gmail.com
Reviewed-by: Norbert Thiebaud nthieb...@gmail.com
diff --git a/filter/source/svg/svgexport.cxx b/filter/source/svg/svgexport.cxx
index 7d0914a..a73ce92 100644
--- a/filter/source/svg/svgexport.cxx
+++ b/filter/source/svg/svgexport.cxx
@@ -799,13 +799,9 @@ bool SVGFilter::implExportDocument()
aAttr += OUString::number(nDocWidth) + + OUString::number(nDocHeight);
-msClipPathId = presentation_clip_path;
-OUString sClipPathAttrValue = url(# + msClipPathId + );
-
mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, viewBox, aAttr );
mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, preserveAspectRatio,
xMidYMid );
mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, fill-rule, evenodd );
-mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, clip-path,
sClipPathAttrValue );
// standard line width is based on 1 pixel on a 90 DPI device (0.28222mmm)
mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, stroke-width,
OUString::number( 28.222 ) );
@@ -822,6 +818,7 @@ bool SVGFilter::implExportDocument()
mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, class,
ClipPathGroup );
SvXMLElementExport aDefsElem( *mpSVGExport, XML_NAMESPACE_NONE,
defs, true, true );
{
+msClipPathId = presentation_clip_path;
mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, id, msClipPathId
);
mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, clipPathUnits,
userSpaceOnUse );
SvXMLElementExport aClipPathElem( *mpSVGExport,
XML_NAMESPACE_NONE, clipPath, true, true );
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source
filter/source/svg/svgexport.cxx |4 ++--
filter/source/svg/svgwriter.cxx |4 +++-
2 files changed, 5 insertions(+), 3 deletions(-)
New commits:
commit f6a67357ab8f827ba934eb40f79fcc58391f909a
Author: Chr. Rossmanith chrrossman...@gmx.de
Date: Wed Mar 25 22:49:13 2015 +0100
tdf#56467: improve export of formulas to SVG
tspan element only valid as child of text element
if exporting a selection use top left corner of bounding rect as top left
corner of viewbox
export x coordinate of text position for text portions
Change-Id: I8b739085473aa4a48ff3e8c413c3cddbaebd
Reviewed-on: https://gerrit.libreoffice.org/14992
Reviewed-by: Thorsten Behrens t...@documentfoundation.org
Tested-by: Thorsten Behrens t...@documentfoundation.org
Reviewed-on: https://gerrit.libreoffice.org/15087
Reviewed-by: Adolfo Jayme Barrientos fit...@ubuntu.com
Tested-by: Adolfo Jayme Barrientos fit...@ubuntu.com
diff --git a/filter/source/svg/svgexport.cxx b/filter/source/svg/svgexport.cxx
index ca9d495..7d0914a 100644
--- a/filter/source/svg/svgexport.cxx
+++ b/filter/source/svg/svgexport.cxx
@@ -826,8 +826,8 @@ bool SVGFilter::implExportDocument()
mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, clipPathUnits,
userSpaceOnUse );
SvXMLElementExport aClipPathElem( *mpSVGExport,
XML_NAMESPACE_NONE, clipPath, true, true );
{
-mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, x,
OUString::number( 0 ) );
-mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, y,
OUString::number( 0 ) );
+mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, x,
OUString::number( nDocX ) );
+mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, y,
OUString::number( nDocY ) );
mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, width,
OUString::number( nDocWidth ) );
mpSVGExport-AddAttribute( XML_NAMESPACE_NONE, height,
OUString::number( nDocHeight ) );
SvXMLElementExport aRectElem( *mpSVGExport,
XML_NAMESPACE_NONE, rect, true, true );
diff --git a/filter/source/svg/svgwriter.cxx b/filter/source/svg/svgwriter.cxx
index 6d2efba..89ae3e3 100644
--- a/filter/source/svg/svgwriter.cxx
+++ b/filter/source/svg/svgwriter.cxx
@@ -1540,7 +1540,7 @@ void SVGTextWriter::implWriteTextPortion( const Point
rPos,
else
aPos = rPos;
-if( mbPositioningNeeded )
+if( mbPositioningNeeded || bApplyMapping )
{
mbPositioningNeeded = false;
maTextPos.setX( aPos.X() );
@@ -3509,7 +3509,9 @@ void SVGActionWriter::ImplWriteActions( const
GDIMetaFile rMtf,
}
else
{
+maTextWriter.startTextShape();
maTextWriter.writeTextPortion( pA-GetPoint(),
aText );
+maTextWriter.endTextShape();
}
}
}
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source
filter/source/flash/swfwriter1.cxx |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit 3fdc79f191e629042a8e448c7d643a1cd487e3c8 Author: Matthew Francis mjay.fran...@gmail.com Date: Wed Jan 21 23:58:03 2015 +0800 fdo#84336 Fix swf rendering Commit d83dfeb5e59c8f3de12d673b001a44001f644e7d accidentally inverted a test, causing at least the presentation linked on the above bug to render all black Change-Id: I2267ef43023b735587d6921f17aa7207f70dbd7b Reviewed-on: https://gerrit.libreoffice.org/14084 Reviewed-by: Caolán McNamara caol...@redhat.com Tested-by: Caolán McNamara caol...@redhat.com (cherry picked from commit eb4c29f4d10ae4be0e6be15a4c7c8c5bfb1edcc3) Reviewed-on: https://gerrit.libreoffice.org/14085 diff --git a/filter/source/flash/swfwriter1.cxx b/filter/source/flash/swfwriter1.cxx index e2c34c1..ae9d1a0 100644 --- a/filter/source/flash/swfwriter1.cxx +++ b/filter/source/flash/swfwriter1.cxx @@ -178,7 +178,7 @@ void Writer::Impl_addShapeRecordChange( BitStream rBits, sal_Int16 dx, sal_Int1 rBits.writeUB( 0, 1 ); // StateNewStyles rBits.writeUB( sal_uInt32(!bFilled), 1 ); // StateLineStyle rBits.writeUB( 0, 1 ); // StateFillStyle0 -rBits.writeUB( bFilled ? 0 : 1, 1 );// StateFillStyle1 +rBits.writeUB( bFilled ? 1 : 0, 1 );// StateFillStyle1 rBits.writeUB( 1, 1 ); // StateMoveTo sal_uInt16 nMoveBits = max( getMaxBitsSigned( dx ), getMaxBitsSigned( dy ) ); ___ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source include/vcl vcl/source
filter/source/msfilter/mstoolbar.cxx |2 -
include/vcl/dibtools.hxx |3 +-
vcl/source/gdi/dibtools.cxx | 39 ---
3 files changed, 35 insertions(+), 9 deletions(-)
New commits:
commit c2d8b640793f665b15b42cda4ad2dcb9d843216d
Author: Caolán McNamara caol...@redhat.com
Date: Mon Jan 12 13:27:21 2015 +
Resolves: fdo#87015 image missing from doc
regression from
commit e0cce521f1ad0cc384d30ce2f1077ea229fffe62
Author: Armin Le Grand a...@apache.org
AuthorDate: Thu Jan 10 16:28:40 2013 +
Commit: Caolán McNamara caol...@redhat.com
CommitDate: Thu Jun 13 14:50:46 2013 +0100
Resolves: #i121504# Support for alpha channel in clipboard for all
systems
(cherry picked from commit ef3931ff410117e1237b3bef7bc090e8b83b9519)
which blindly just bulldozed out the bMSOFormat branch
Change-Id: Iec354f1fb585f0803b9df472bc9ec9e103aa5847
(cherry picked from commit 470fcca594ba4f6bf473d4d44b415c2ba151b0d9)
Reviewed-on: https://gerrit.libreoffice.org/13874
Reviewed-by: Andras Timar andras.ti...@collabora.com
Tested-by: Andras Timar andras.ti...@collabora.com
diff --git a/filter/source/msfilter/mstoolbar.cxx
b/filter/source/msfilter/mstoolbar.cxx
index 328b828..2e13d3b 100644
--- a/filter/source/msfilter/mstoolbar.cxx
+++ b/filter/source/msfilter/mstoolbar.cxx
@@ -724,7 +724,7 @@ bool TBCBitMap::Read( SvStream rS)
nOffSet = rS.Tell();
rS.ReadInt32( cbDIB );
// cbDIB = sizeOf(biHeader) + sizeOf(colors) + sizeOf(bitmapData) + 10
-return ReadDIB(mBitMap, rS, false);
+return ReadDIB(mBitMap, rS, false, true);
}
#if OSL_DEBUG_LEVEL 1
diff --git a/include/vcl/dibtools.hxx b/include/vcl/dibtools.hxx
index 6091f6e..a43764f 100644
--- a/include/vcl/dibtools.hxx
+++ b/include/vcl/dibtools.hxx
@@ -36,7 +36,8 @@ class Bitmap;
bool VCL_DLLPUBLIC ReadDIB( // ReadDIB(rBitmap, rIStm, true);
Bitmap rTarget,
SvStream rIStm,
-bool bFileHeader);
+bool bFileHeader,
+bool bMSOFormat=false);
bool VCL_DLLPUBLIC ReadDIBBitmapEx(
BitmapEx rTarget,
diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx
index af6a78e..247ce7c 100644
--- a/vcl/source/gdi/dibtools.cxx
+++ b/vcl/source/gdi/dibtools.cxx
@@ -166,7 +166,7 @@ namespace
}
}
-bool ImplReadDIBInfoHeader(SvStream rIStm, DIBV5Header rHeader, bool
bTopDown)
+bool ImplReadDIBInfoHeader(SvStream rIStm, DIBV5Header rHeader, bool
bTopDown, bool bMSOFormat)
{
// BITMAPINFOHEADER or BITMAPCOREHEADER or BITMAPV5HEADER
const sal_Size aStartPos(rIStm.Tell());
@@ -182,6 +182,29 @@ bool ImplReadDIBInfoHeader(SvStream rIStm, DIBV5Header
rHeader, bool bTopDown
rIStm.ReadUInt16( rHeader.nPlanes );
rIStm.ReadUInt16( rHeader.nBitCount );
}
+else if ( bMSOFormat rHeader.nSize == DIBINFOHEADERSIZE )
+{
+sal_Int16 nTmp16(0);
+rIStm.ReadInt16(nTmp16);
+rHeader.nWidth = nTmp16;
+rIStm.ReadInt16(nTmp16);
+rHeader.nHeight = nTmp16;
+sal_uInt8 nTmp8(0);
+rIStm.ReadUChar(nTmp8);
+rHeader.nPlanes = nTmp8;
+rIStm.ReadUChar(nTmp8);
+rHeader.nBitCount = nTmp8;
+rIStm.ReadInt16(nTmp16);
+rHeader.nSizeImage = nTmp16;
+rIStm.ReadInt16(nTmp16);
+rHeader.nCompression = nTmp16;
+if ( !rHeader.nSizeImage ) // uncompressed?
+rHeader.nSizeImage = ((rHeader.nWidth * rHeader.nBitCount + 31)
~31) / 8 * rHeader.nHeight;
+rIStm.ReadInt32( rHeader.nXPelsPerMeter );
+rIStm.ReadInt32( rHeader.nYPelsPerMeter );
+rIStm.ReadUInt32( rHeader.nColsUsed );
+rIStm.ReadUInt32( rHeader.nColsImportant );
+}
else
{
// BITMAPCOREHEADER, BITMAPV5HEADER or unknown. Read as far as possible
@@ -679,14 +702,14 @@ bool ImplReadDIBBits(SvStream rIStm, DIBV5Header
rHeader, BitmapWriteAccess r
return( rIStm.GetError() == 0UL );
}
-bool ImplReadDIBBody( SvStream rIStm, Bitmap rBmp, Bitmap* pBmpAlpha,
sal_uLong nOffset )
+bool ImplReadDIBBody( SvStream rIStm, Bitmap rBmp, Bitmap* pBmpAlpha,
sal_uLong nOffset, bool bMSOFormat = false )
{
DIBV5Header aHeader;
const sal_uLong nStmPos = rIStm.Tell();
bool bRet(false);
bool bTopDown(false);
-if(ImplReadDIBInfoHeader(rIStm, aHeader, bTopDown) aHeader.nWidth
aHeader.nHeight aHeader.nBitCount)
+if(ImplReadDIBInfoHeader(rIStm, aHeader, bTopDown, bMSOFormat)
aHeader.nWidth aHeader.nHeight aHeader.nBitCount)
{
// In case ImplReadDIB() didn't call ImplReadDIBFileHeader() before
// this method, nOffset is 0, that's OK.
@@ -1412,7 +1435,8 @@ bool ImplReadDIB(
Bitmap rTarget, Bitmap*
pTargetAlpha,
SvStream rIStm,
-bool bFileHeader)
+bool bFileHeader,
+bool bMSOFormat=false)
{
const sal_uInt16 nOldFormat(rIStm.GetNumberFormatInt());
const sal_uLong
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source
filter/source/graphicfilter/itiff/itiff.cxx | 11 +--
1 file changed, 5 insertions(+), 6 deletions(-)
New commits:
commit 75bec3ec6a5aa4f792e8bc81bc441254d9aff18c
Author: Caolán McNamara caol...@redhat.com
Date: Mon Jan 5 10:56:32 2015 +
asan wrt mandriva57054-1.tiff
Change-Id: Ibb7ecfa637ff96fbda3a8ed5d67943ece28927e5
(cherry picked from commit f901624b5e13e300f8e2facd2a824202c21d9729)
Reviewed-on: https://gerrit.libreoffice.org/13738
Reviewed-by: Markus Mohrhard markus.mohrh...@googlemail.com
Tested-by: Markus Mohrhard markus.mohrh...@googlemail.com
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx
b/filter/source/graphicfilter/itiff/itiff.cxx
index 719f51d..9dfa328 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -928,23 +928,22 @@ bool TIFFReader::ConvertScanline( sal_uLong nY )
{
case 8 :
{
-sal_uInt8 nLast;
if ( bByteSwap )
{
if ( nPredictor == 2 )
{
-nLast = BYTESWAP( (sal_uInt8)*pt++ );
+sal_uInt8 nLast = 0;
for ( nx = 0; nx nImageWidth; nx++ )
{
+nLast += nx == 0 ? BYTESWAP( (sal_uInt8)*pt++
) : *pt++;
pAcc-SetPixelIndex( nY, nx, nLast );
-nLast = nLast + *pt++;
}
}
else
{
for ( nx = 0; nx nImageWidth; nx++ )
{
-nLast = *pt++;
+sal_uInt8 nLast = *pt++;
pAcc-SetPixelIndex( nY, nx,
static_castsal_uInt8( (BYTESWAP((sal_uLong)nLast) - nMinSampleValue) *
nMinMax ) );
}
}
@@ -953,11 +952,11 @@ bool TIFFReader::ConvertScanline( sal_uLong nY )
{
if ( nPredictor == 2 )
{
-nLast = *pt++;
+sal_uInt8 nLast = 0;
for ( nx = 0; nx nImageWidth; nx++ )
{
+nLast += *pt++;
pAcc-SetPixelIndex( nY, nx, nLast );
-nLast = nLast + *pt++;
}
}
else
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source
filter/source/xsltdialog/xmlfiltersettingsdialog.cxx |7 ++-
1 file changed, 6 insertions(+), 1 deletion(-)
New commits:
commit 40d11c282cae31bd82e87fd0a0ea54c162e7e53c
Author: Caolán McNamara caol...@redhat.com
Date: Mon Dec 8 09:50:52 2014 +
Related: rhbz#1164614 better default size for no xslt entries case
Change-Id: I75dd1210b4e8e5e7cb2c2ce1e83e085a9c480b91
diff --git a/filter/source/xsltdialog/xmlfiltersettingsdialog.cxx
b/filter/source/xsltdialog/xmlfiltersettingsdialog.cxx
index fc0da39..7c32e25 100644
--- a/filter/source/xsltdialog/xmlfiltersettingsdialog.cxx
+++ b/filter/source/xsltdialog/xmlfiltersettingsdialog.cxx
@@ -1390,7 +1390,12 @@ void SvxPathControl::Resize()
Size SvxPathControl::GetOptimalSize() const
{
-return m_pVBox-GetOptimalSize();
+Size aDefSize(LogicToPixel(Size(150, 0), MapMode(MAP_APPFONT)));
+Size aOptSize(m_pVBox-GetOptimalSize());
+long nRowHeight(GetTextHeight());
+aOptSize.Height() = nRowHeight * 10;
+aOptSize.Width() = std::max(aDefSize.Width(), aOptSize.Width());
+return aOptSize;
}
SvxPathControl::~SvxPathControl()
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/source
filter/source/msfilter/msdffimp.cxx |8
1 file changed, 4 insertions(+), 4 deletions(-)
New commits:
commit 544ad733b8a97b62a68c7d0f60f13c8f699407dd
Author: Andras Timar andras.ti...@collabora.com
Date: Thu Nov 27 20:56:32 2014 +0100
fdo#84686 prevent std::bad_alloc exception by stricter input check
The bugdoc has invalid length (rh.recLen) in header of blipStore's
OfficeArtFBSE record. Therefore LibreOffice read junk for the next
BLIP, and tried to seek to an invalid stream position, which caused
bad allocation exception on 32-bit systems.
Change-Id: I72fae4c2b00216b57736f4409a32c62a40f25785
(cherry picked from commit 6945971c79d70d77c5c8bb6593b3f25ef46b0887)
diff --git a/filter/source/msfilter/msdffimp.cxx
b/filter/source/msfilter/msdffimp.cxx
index 466faf6..be3c003 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -5798,8 +5798,7 @@ void SvxMSDffManager::GetCtrlData( sal_uInt32 nOffsDgg_ )
}
-// from here on: Drawing Group Container i.e. Ddocument-wide valid data
-// ===
+// from here on: Drawing Group Container i.e. document-wide valid data
void SvxMSDffManager::GetDrawingGroupContainerData( SvStream rSt, sal_uLong
nLenDgg )
{
@@ -5839,7 +5838,7 @@ void SvxMSDffManager::GetDrawingGroupContainerData(
SvStream rSt, sal_uLong nLe
{
if(!ReadCommonRecordHeader( rSt, nVer, nInst, nFbt, nLength)) return;
nRead += DFF_COMMON_RECORD_HEADER_SIZE + nLength;
-if( DFF_msofbtBSE == nFbt )
+if( DFF_msofbtBSE == nFbt /* magic value from spec */ 0x2 == nVer )
{
nLenFBSE = nLength;
// is FBSE big enough for our data
@@ -5876,8 +5875,9 @@ void SvxMSDffManager::GetDrawingGroupContainerData(
SvStream rSt, sal_uLong nLe
// now save the info for later access
pBLIPInfos-push_back( new SvxMSDffBLIPInfo( nInst, nBLIPPos,
nBLIPLen ) );
}
+rSt.SeekRel( nLength );
}
-rSt.SeekRel( nLength );
+else return; // invalid input
}
while( nRead nLenBStoreCont );
}
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
