mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ofz#17823 avoid timeout

Browse Source 
Change-Id: I3658d476873a502adc0cbd8be9a4f6ffd5b62c87
Reviewed-on: https://gerrit.libreoffice.org/80236
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
This commit is contained in:
Caolán McNamara
2019-10-04 16:32:07 +01:00
parent ba32c66468
commit 8bb5b028b9
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
hwpfilter/source/hwpread.cxx
View File

@@ -20,6 +20,7 @@
#include "precompile.h" #include "precompile.h"
#include <comphelper/newarray.hxx> #include <comphelper/newarray.hxx>
#include <unotools/configmgr.hxx>
#include <assert.h> #include <assert.h>
#include <list> #include <list>
@@ -376,6 +377,10 @@ bool Picture::Read(HWPFile & hwpf)
hwpf.AddBox(this); hwpf.AddBox(this);
hwpf.Read4b(&follow_block_size, 1); hwpf.Read4b(&follow_block_size, 1);
//when fuzzing with a max len set, max decompress to 10 times that limit
static size_t nMaxAllowedDecompression = [](const char* pEnv) { size_t nRet = pEnv ? std::atoi(pEnv) : 0; return nRet * 10; }(std::getenv("FUZZ_MAX_INPUT_LEN"));
hwpf.Read2b(&dummy1, 1); /* Reserved 4 bytes */ hwpf.Read2b(&dummy1, 1); /* Reserved 4 bytes */
hwpf.Read2b(&dummy2, 1); hwpf.Read2b(&dummy2, 1);
@@ -455,6 +460,8 @@ bool Picture::Read(HWPFile & hwpf)
} }
if (nBlock != nReadBlock) if (nBlock != nReadBlock)
break; break;
if (nMaxAllowedDecompression && follow.size() > nMaxAllowedDecompression)
break;
} }
follow_block_size = follow.size(); follow_block_size = follow.size();
@@ -476,6 +483,8 @@ bool Picture::Read(HWPFile & hwpf)
ishyper = true; ishyper = true;
} }
} }
else
fprintf(stderr, "arse\n");
} }
if( pictype != 3 ) if( pictype != 3 )