mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ofz: check if the stream is able to meet the eps len claim before reading

Browse Source 
Change-Id: I440c7f38d6588c570a411f2a97c0164e5d7d646f
This commit is contained in:
Caolán McNamara
2017-01-27 08:58:51 +00:00
parent b602313ab8
commit d1f3168162
1 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
filter/source/graphicfilter/ieps/ieps.cxx
View File

@@ -399,6 +399,15 @@ static bool RenderAsBMP(const sal_uInt8* pBuf, sal_uInt32 nBytesRead, Graphic &r
return RenderAsBMPThroughConvert(pBuf, nBytesRead, rGraphic);
}
namespace
{
bool checkSeek(SvStream &rSt, sal_uInt32 nOffset)
{
const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize());
return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset);
}
}
// this method adds a replacement action containing the original wmf or tiff replacement,
// so the original eps can be written when storing to ODF.
void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32 nOrigPos, sal_uInt32 nPSSize,
@@ -416,17 +425,15 @@ void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32
aReplacement.WriteUInt32( nMagic ).WriteUInt32( nPPos ).WriteUInt32( nPSSize )
.WriteUInt32( nWPos ).WriteUInt32( nSizeWMF )
.WriteUInt32( nTPos ).WriteUInt32( nSizeTIFF );
if ( nSizeWMF )
if (nSizeWMF && checkSeek(rStrm, nOrigPos + nPosWMF) && rStrm.remainingSize() >= nSizeWMF)
{
std::unique_ptr<sal_uInt8[]> pBuf(new sal_uInt8[ nSizeWMF ]);
rStrm.Seek( nOrigPos + nPosWMF );
rStrm.ReadBytes(pBuf.get(), nSizeWMF);
aReplacement.WriteBytes(pBuf.get(), nSizeWMF);
}
if ( nSizeTIFF )
if (nSizeTIFF && checkSeek(rStrm, nOrigPos + nPosTIFF) && rStrm.remainingSize() >= nSizeTIFF)
{
std::unique_ptr<sal_uInt8[]> pBuf(new sal_uInt8[ nSizeTIFF ]);
rStrm.Seek( nOrigPos + nPosTIFF );
rStrm.ReadBytes(pBuf.get(), nSizeTIFF);
aReplacement.WriteBytes(pBuf.get(), nSizeTIFF);
}
@@ -519,15 +526,6 @@ void MakePreview(sal_uInt8* pBuf, sal_uInt32 nBytesRead,
rGraphic = aMtf;
}
namespace
{
bool checkSeek(SvStream &rSt, sal_uInt32 nOffset)
{
const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize());
return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset);
}
}
//================== GraphicImport - the exported function ================