mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

validate polypolygon point counts

Browse Source 
Change-Id: Ibf6bdf48e5855583f14cd2be36f1e4896a396d32
This commit is contained in:
Caolán McNamara
2012-08-08 21:39:50 +01:00
parent 0d2abfdbd4
commit 919632bd5e
1 changed files with 61 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
svtools/source/filter/wmf/winwmf.cxx
View File

@@ -28,6 +28,7 @@
#include "winmtf.hxx" #include "winmtf.hxx"
#include <boost/scoped_array.hpp>
#include <vcl/gdimtf.hxx> #include <vcl/gdimtf.hxx>
#include <svtools/wmf.hxx> #include <svtools/wmf.hxx>
#include <rtl/crc.h> #include <rtl/crc.h>
@@ -354,28 +355,55 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
case W_META_POLYPOLYGON: case W_META_POLYPOLYGON:
{ {
bool bRecordOk = true;
sal_uInt16 nPoly = 0; sal_uInt16 nPoly = 0;
Point* pPtAry; Point* pPtAry;
// Number of polygons: // Number of polygons:
*pWMF >> nPoly; *pWMF >> nPoly;
// Number of points of each polygon. Determine total number of points // Number of points of each polygon. Determine total number of points
sal_uInt16* pnPoints = new sal_uInt16[ nPoly ]; boost::scoped_array<sal_uInt16> xPolygonPointCounts(new sal_uInt16[nPoly]);
sal_uInt16* pnPoints = xPolygonPointCounts.get();
sal_uInt16 nPoints = 0; sal_uInt16 nPoints = 0;
for(sal_uInt16 i = 0; i < nPoly; i++ ) for(sal_uInt16 i = 0; i < nPoly; i++ )
{ {
*pWMF >> pnPoints[i]; *pWMF >> pnPoints[i];
if (pnPoints[i] > SAL_MAX_UINT16 - nPoints)
{
bRecordOk = false;
break;
}
nPoints += pnPoints[i]; nPoints += pnPoints[i];
} }
SAL_WARN_IF(!bRecordOk, "svtools", "polypolygon record has more polygons that we can handle");
bRecordOk &= pWMF->good();
if (!bRecordOk)
{
pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
break;
}
// Polygon points are: // Polygon points are:
pPtAry = new Point[nPoints]; boost::scoped_array<Point> xPolygonPoints(new Point[nPoints]);
pPtAry = xPolygonPoints.get();
for (sal_uInt16 i = 0; i < nPoints; i++ ) for (sal_uInt16 i = 0; i < nPoints; i++ )
pPtAry[ i ] = ReadPoint(); pPtAry[ i ] = ReadPoint();
bRecordOk &= pWMF->good();
if (!bRecordOk)
{
pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
break;
}
// Produce PolyPolygon Actions // Produce PolyPolygon Actions
PolyPolygon aPolyPoly( nPoly, pnPoints, pPtAry ); PolyPolygon aPolyPoly( nPoly, pnPoints, pPtAry );
pOut->DrawPolyPolygon( aPolyPoly ); pOut->DrawPolyPolygon( aPolyPoly );
delete[] pPtAry;
delete[] pnPoints;
} }
break; break;
@@ -1329,16 +1357,43 @@ sal_Bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pSt
case W_META_POLYPOLYGON: case W_META_POLYPOLYGON:
{ {
bool bRecordOk = true;
sal_uInt16 nPoly, nPoints = 0; sal_uInt16 nPoly, nPoints = 0;
*pStm >> nPoly; *pStm >> nPoly;
for(sal_uInt16 i = 0; i < nPoly; i++ ) for(sal_uInt16 i = 0; i < nPoly; i++ )
{ {
sal_uInt16 nP; sal_uInt16 nP = 0;
*pStm >> nP; *pStm >> nP;
nPoints = nPoints + nP; if (nP > SAL_MAX_UINT16 - nPoints)
{
bRecordOk = false;
break;
}
nPoints += nP;
} }
SAL_WARN_IF(!bRecordOk, "svtools", "polypolygon record has more polygons that we can handle");
bRecordOk &= pStm->good();
if (!bRecordOk)
{
pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
bRet = sal_False;
break;
}
for (sal_uInt16 i = 0; i < nPoints; i++ ) for (sal_uInt16 i = 0; i < nPoints; i++ )
GetWinExtMax( ReadPoint(), rPlaceableBound, nMapMode ); GetWinExtMax( ReadPoint(), rPlaceableBound, nMapMode );
bRecordOk &= pStm->good();
if (!bRecordOk)
{
pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
bRet = sal_False;
break;
}
} }
break; break;