From d1f31681623696e99b0bd9e98570cb1ebac518cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= Date: Fri, 27 Jan 2017 08:58:51 +0000 Subject: [PATCH] ofz: check if the stream is able to meet the eps len claim before reading Change-Id: I440c7f38d6588c570a411f2a97c0164e5d7d646f --- filter/source/graphicfilter/ieps/ieps.cxx | 24 +++++++++++------------ 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx index 090bc6543e87..2a8f900afa9f 100644 --- a/filter/source/graphicfilter/ieps/ieps.cxx +++ b/filter/source/graphicfilter/ieps/ieps.cxx @@ -399,6 +399,15 @@ static bool RenderAsBMP(const sal_uInt8* pBuf, sal_uInt32 nBytesRead, Graphic &r return RenderAsBMPThroughConvert(pBuf, nBytesRead, rGraphic); } +namespace +{ + bool checkSeek(SvStream &rSt, sal_uInt32 nOffset) + { + const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize()); + return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset); + } +} + // this method adds a replacement action containing the original wmf or tiff replacement, // so the original eps can be written when storing to ODF. void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32 nOrigPos, sal_uInt32 nPSSize, @@ -416,17 +425,15 @@ void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32 aReplacement.WriteUInt32( nMagic ).WriteUInt32( nPPos ).WriteUInt32( nPSSize ) .WriteUInt32( nWPos ).WriteUInt32( nSizeWMF ) .WriteUInt32( nTPos ).WriteUInt32( nSizeTIFF ); - if ( nSizeWMF ) + if (nSizeWMF && checkSeek(rStrm, nOrigPos + nPosWMF) && rStrm.remainingSize() >= nSizeWMF) { std::unique_ptr pBuf(new sal_uInt8[ nSizeWMF ]); - rStrm.Seek( nOrigPos + nPosWMF ); rStrm.ReadBytes(pBuf.get(), nSizeWMF); aReplacement.WriteBytes(pBuf.get(), nSizeWMF); } - if ( nSizeTIFF ) + if (nSizeTIFF && checkSeek(rStrm, nOrigPos + nPosTIFF) && rStrm.remainingSize() >= nSizeTIFF) { std::unique_ptr pBuf(new sal_uInt8[ nSizeTIFF ]); - rStrm.Seek( nOrigPos + nPosTIFF ); rStrm.ReadBytes(pBuf.get(), nSizeTIFF); aReplacement.WriteBytes(pBuf.get(), nSizeTIFF); } @@ -519,15 +526,6 @@ void MakePreview(sal_uInt8* pBuf, sal_uInt32 nBytesRead, rGraphic = aMtf; } -namespace -{ - bool checkSeek(SvStream &rSt, sal_uInt32 nOffset) - { - const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize()); - return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset); - } -} - //================== GraphicImport - the exported function ================