mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

More OUString::copy out-of-bounds fixes

Browse Source 
Change-Id: I45762d167d04252e32155a7b23a3290688bccdf6
This commit is contained in:
Stephan Bergmann
2013-10-09 21:01:15 +02:00
parent f58ee783ee
commit 34e951bd72
5 changed files with 28 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
sfx2/source/appl/linkmgr2.cxx
View File

@@ -246,7 +246,7 @@ bool LinkManager::GetDisplayNames( const SvBaseLink * pLink,
if( pLinkStr ) if( pLinkStr )
*pLinkStr = sRange; *pLinkStr = sRange;
if( pFilter ) if( pFilter )
*pFilter = sLNm.copy( nPos ); *pFilter = nPos == -1 ? OUString() : sLNm.copy(nPos);
if( pType ) if( pType )
{ {

20
starmath/source/parse.cxx
View File

@@ -441,7 +441,7 @@ void SmParser::NextToken()
} }
else if (aRes.TokenType & KParseType::ONE_SINGLE_CHAR) else if (aRes.TokenType & KParseType::ONE_SINGLE_CHAR)
{ {
if (nRealStart + 2 <= nBufLen && m_aBufferString.copy(nRealStart, 2) == "%%") if (nRealStart + 2 <= nBufLen && m_aBufferString.match("%%", nRealStart))
{ {
//SkipComment //SkipComment
m_nBufferIndex = nRealStart + 2; m_nBufferIndex = nRealStart + 2;
@@ -543,7 +543,7 @@ void SmParser::NextToken()
{ {
case '<': case '<':
{ {
if (m_aBufferString.copy(nRealStart, 2) == "<<") if (m_aBufferString.match("<<", nRealStart))
{ {
m_aCurToken.eType = TLL; m_aCurToken.eType = TLL;
m_aCurToken.cMathChar = MS_LL; m_aCurToken.cMathChar = MS_LL;
@@ -553,7 +553,7 @@ void SmParser::NextToken()
rnEndPos = nRealStart + 2; rnEndPos = nRealStart + 2;
} }
else if (m_aBufferString.copy(nRealStart, 2) == "<=") else if (m_aBufferString.match("<=", nRealStart))
{ {
m_aCurToken.eType = TLE; m_aCurToken.eType = TLE;
m_aCurToken.cMathChar = MS_LE; m_aCurToken.cMathChar = MS_LE;
@@ -563,7 +563,7 @@ void SmParser::NextToken()
rnEndPos = nRealStart + 2; rnEndPos = nRealStart + 2;
} }
else if (m_aBufferString.copy(nRealStart, 2) == "<>") else if (m_aBufferString.match("<>", nRealStart))
{ {
m_aCurToken.eType = TNEQ; m_aCurToken.eType = TNEQ;
m_aCurToken.cMathChar = MS_NEQ; m_aCurToken.cMathChar = MS_NEQ;
@@ -573,7 +573,7 @@ void SmParser::NextToken()
rnEndPos = nRealStart + 2; rnEndPos = nRealStart + 2;
} }
else if (m_aBufferString.copy(nRealStart, 3) == "<?>") else if (m_aBufferString.match("<?>", nRealStart))
{ {
m_aCurToken.eType = TPLACE; m_aCurToken.eType = TPLACE;
m_aCurToken.cMathChar = MS_PLACE; m_aCurToken.cMathChar = MS_PLACE;
@@ -595,7 +595,7 @@ void SmParser::NextToken()
break; break;
case '>': case '>':
{ {
if (m_aBufferString.copy(nRealStart, 2) == ">=") if (m_aBufferString.match(">=", nRealStart))
{ {
m_aCurToken.eType = TGE; m_aCurToken.eType = TGE;
m_aCurToken.cMathChar = MS_GE; m_aCurToken.cMathChar = MS_GE;
@@ -605,7 +605,7 @@ void SmParser::NextToken()
rnEndPos = nRealStart + 2; rnEndPos = nRealStart + 2;
} }
else if (m_aBufferString.copy(nRealStart, 2) == ">>") else if (m_aBufferString.match(">>", nRealStart))
{ {
m_aCurToken.eType = TGG; m_aCurToken.eType = TGG;
m_aCurToken.cMathChar = MS_GG; m_aCurToken.cMathChar = MS_GG;
@@ -770,7 +770,7 @@ void SmParser::NextToken()
break; break;
case '#': case '#':
{ {
if (m_aBufferString.copy(nRealStart, 2) == "##") if (m_aBufferString.match("##", nRealStart))
{ {
m_aCurToken.eType = TDPOUND; m_aCurToken.eType = TDPOUND;
m_aCurToken.cMathChar = '\0'; m_aCurToken.cMathChar = '\0';
@@ -828,7 +828,7 @@ void SmParser::NextToken()
break; break;
case '+': case '+':
{ {
if (m_aBufferString.copy(nRealStart, 2) == "+-") if (m_aBufferString.match("+-", nRealStart))
{ {
m_aCurToken.eType = TPLUSMINUS; m_aCurToken.eType = TPLUSMINUS;
m_aCurToken.cMathChar = MS_PLUSMINUS; m_aCurToken.cMathChar = MS_PLUSMINUS;
@@ -850,7 +850,7 @@ void SmParser::NextToken()
break; break;
case '-': case '-':
{ {
if (m_aBufferString.copy(nRealStart, 2) == "-+") if (m_aBufferString.match("-+", nRealStart))
{ {
m_aCurToken.eType = TMINUSPLUS; m_aCurToken.eType = TMINUSPLUS;
m_aCurToken.cMathChar = MS_MINUSPLUS; m_aCurToken.cMathChar = MS_MINUSPLUS;

4
vcl/source/control/field2.cxx
View File

@@ -19,6 +19,8 @@
#include "sal/config.h" #include "sal/config.h"
#include <algorithm>
#include <tools/diagnose_ex.h> #include <tools/diagnose_ex.h>
#include <comphelper/processfactory.hxx> #include <comphelper/processfactory.hxx>
#include <comphelper/string.hxx> #include <comphelper/string.hxx>
@@ -1015,7 +1017,7 @@ static sal_uInt16 ImplCutNumberFromString( OUString& rStr )
++i2; ++i2;
} }
sal_Int32 nValue = rStr.copy(i1, i2-i1).toInt32(); sal_Int32 nValue = rStr.copy(i1, i2-i1).toInt32();
rStr = rStr.copy(i2+1); rStr = rStr.copy(std::min(i2+1, rStr.getLength()));
return nValue; return nValue;
} }

10
vcl/source/filter/wmf/emfwr.cxx
View File

@@ -17,6 +17,10 @@
* the License at http://www.apache.org/licenses/LICENSE-2.0 . * the License at http://www.apache.org/licenses/LICENSE-2.0 .
*/ */
#include "sal/config.h"
#include <algorithm>
#include "emfwr.hxx" #include "emfwr.hxx"
#include <rtl/strbuf.hxx> #include <rtl/strbuf.hxx>
#include <tools/helpers.hxx> #include <tools/helpers.hxx>
@@ -1353,7 +1357,7 @@ void EMFWriter::ImplWrite( const GDIMetaFile& rMtf )
case META_TEXT_ACTION: case META_TEXT_ACTION:
{ {
const MetaTextAction* pA = (const MetaTextAction*) pAction; const MetaTextAction* pA = (const MetaTextAction*) pAction;
const OUString aText = pA->GetText().copy( pA->GetIndex(), pA->GetLen() ); const OUString aText = pA->GetText().copy( pA->GetIndex(), std::min<sal_Int32>(pA->GetText().getLength() - pA->GetIndex(), pA->GetLen()) );
ImplCheckTextAttr(); ImplCheckTextAttr();
ImplWriteTextRecord( pA->GetPoint(), aText, NULL, 0 ); ImplWriteTextRecord( pA->GetPoint(), aText, NULL, 0 );
@@ -1373,7 +1377,7 @@ void EMFWriter::ImplWrite( const GDIMetaFile& rMtf )
case META_TEXTARRAY_ACTION: case META_TEXTARRAY_ACTION:
{ {
const MetaTextArrayAction* pA = (const MetaTextArrayAction*) pAction; const MetaTextArrayAction* pA = (const MetaTextArrayAction*) pAction;
const OUString aText = pA->GetText().copy( pA->GetIndex(), pA->GetLen() ); const OUString aText = pA->GetText().copy( pA->GetIndex(), std::min<sal_Int32>(pA->GetText().getLength() - pA->GetIndex(), pA->GetLen()) );
ImplCheckTextAttr(); ImplCheckTextAttr();
ImplWriteTextRecord( pA->GetPoint(), aText, pA->GetDXArray(), 0 ); ImplWriteTextRecord( pA->GetPoint(), aText, pA->GetDXArray(), 0 );
@@ -1383,7 +1387,7 @@ void EMFWriter::ImplWrite( const GDIMetaFile& rMtf )
case META_STRETCHTEXT_ACTION: case META_STRETCHTEXT_ACTION:
{ {
const MetaStretchTextAction* pA = (const MetaStretchTextAction*) pAction; const MetaStretchTextAction* pA = (const MetaStretchTextAction*) pAction;
const OUString aText = pA->GetText().copy( pA->GetIndex(), pA->GetLen() ); const OUString aText = pA->GetText().copy( pA->GetIndex(), std::min<sal_Int32>(pA->GetText().getLength() - pA->GetIndex(), pA->GetLen()) );
ImplCheckTextAttr(); ImplCheckTextAttr();
ImplWriteTextRecord( pA->GetPoint(), aText, NULL, pA->GetWidth() ); ImplWriteTextRecord( pA->GetPoint(), aText, NULL, pA->GetWidth() );

10
vcl/source/filter/wmf/wmfwr.cxx
View File

@@ -17,6 +17,10 @@
* the License at http://www.apache.org/licenses/LICENSE-2.0 . * the License at http://www.apache.org/licenses/LICENSE-2.0 .
*/ */
#include "sal/config.h"
#include <algorithm>
#include "wmfwr.hxx" #include "wmfwr.hxx"
#include <unotools/fontcvt.hxx> #include <unotools/fontcvt.hxx>
#include "emfwr.hxx" #include "emfwr.hxx"
@@ -1182,7 +1186,7 @@ void WMFWriter::WriteRecords( const GDIMetaFile & rMTF )
case META_TEXT_ACTION: case META_TEXT_ACTION:
{ {
const MetaTextAction * pA = (const MetaTextAction*) pMA; const MetaTextAction * pA = (const MetaTextAction*) pMA;
OUString aTemp = pA->GetText().copy( pA->GetIndex(), pA->GetLen() ); OUString aTemp = pA->GetText().copy( pA->GetIndex(), std::min<sal_Int32>(pA->GetText().getLength() - pA->GetIndex(), pA->GetLen()) );
aSrcLineInfo = LineInfo(); aSrcLineInfo = LineInfo();
SetAllAttr(); SetAllAttr();
if ( !WMFRecord_Escape_Unicode( pA->GetPoint(), aTemp, NULL ) ) if ( !WMFRecord_Escape_Unicode( pA->GetPoint(), aTemp, NULL ) )
@@ -1194,7 +1198,7 @@ void WMFWriter::WriteRecords( const GDIMetaFile & rMTF )
{ {
const MetaTextArrayAction* pA = (const MetaTextArrayAction*) pMA; const MetaTextArrayAction* pA = (const MetaTextArrayAction*) pMA;
OUString aTemp = pA->GetText().copy( pA->GetIndex(), pA->GetLen() ); OUString aTemp = pA->GetText().copy( pA->GetIndex(), std::min<sal_Int32>(pA->GetText().getLength() - pA->GetIndex(), pA->GetLen()) );
aSrcLineInfo = LineInfo(); aSrcLineInfo = LineInfo();
SetAllAttr(); SetAllAttr();
if ( !WMFRecord_Escape_Unicode( pA->GetPoint(), aTemp, pA->GetDXArray() ) ) if ( !WMFRecord_Escape_Unicode( pA->GetPoint(), aTemp, pA->GetDXArray() ) )
@@ -1205,7 +1209,7 @@ void WMFWriter::WriteRecords( const GDIMetaFile & rMTF )
case META_STRETCHTEXT_ACTION: case META_STRETCHTEXT_ACTION:
{ {
const MetaStretchTextAction* pA = (const MetaStretchTextAction *) pMA; const MetaStretchTextAction* pA = (const MetaStretchTextAction *) pMA;
OUString aTemp = pA->GetText().copy( pA->GetIndex(), pA->GetLen() ); OUString aTemp = pA->GetText().copy( pA->GetIndex(), std::min<sal_Int32>(pA->GetText().getLength() - pA->GetIndex(), pA->GetLen()) );
sal_uInt16 nLen,i; sal_uInt16 nLen,i;
sal_Int32 nNormSize; sal_Int32 nNormSize;