mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ofz: check if the stream is able to meet the eps len claim before reading

Browse Source 
Change-Id: I440c7f38d6588c570a411f2a97c0164e5d7d646f
This commit is contained in:
Caolán McNamara
2017-01-27 08:58:51 +00:00
parent b602313ab8
commit d1f3168162
1 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
filter/source/graphicfilter/ieps/ieps.cxx
View File

@@ -399,6 +399,15 @@ static bool RenderAsBMP(const sal_uInt8* pBuf, sal_uInt32 nBytesRead, Graphic &r
return RenderAsBMPThroughConvert(pBuf, nBytesRead, rGraphic); return RenderAsBMPThroughConvert(pBuf, nBytesRead, rGraphic);
} }
namespace
{
bool checkSeek(SvStream &rSt, sal_uInt32 nOffset)
{
const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize());
return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset);
}
}
// this method adds a replacement action containing the original wmf or tiff replacement, // this method adds a replacement action containing the original wmf or tiff replacement,
// so the original eps can be written when storing to ODF. // so the original eps can be written when storing to ODF.
void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32 nOrigPos, sal_uInt32 nPSSize, void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32 nOrigPos, sal_uInt32 nPSSize,
@@ -416,17 +425,15 @@ void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32
aReplacement.WriteUInt32( nMagic ).WriteUInt32( nPPos ).WriteUInt32( nPSSize ) aReplacement.WriteUInt32( nMagic ).WriteUInt32( nPPos ).WriteUInt32( nPSSize )
.WriteUInt32( nWPos ).WriteUInt32( nSizeWMF ) .WriteUInt32( nWPos ).WriteUInt32( nSizeWMF )
.WriteUInt32( nTPos ).WriteUInt32( nSizeTIFF ); .WriteUInt32( nTPos ).WriteUInt32( nSizeTIFF );
if ( nSizeWMF ) if (nSizeWMF && checkSeek(rStrm, nOrigPos + nPosWMF) && rStrm.remainingSize() >= nSizeWMF)
{ {
std::unique_ptr<sal_uInt8[]> pBuf(new sal_uInt8[ nSizeWMF ]); std::unique_ptr<sal_uInt8[]> pBuf(new sal_uInt8[ nSizeWMF ]);
rStrm.Seek( nOrigPos + nPosWMF );
rStrm.ReadBytes(pBuf.get(), nSizeWMF); rStrm.ReadBytes(pBuf.get(), nSizeWMF);
aReplacement.WriteBytes(pBuf.get(), nSizeWMF); aReplacement.WriteBytes(pBuf.get(), nSizeWMF);
} }
if ( nSizeTIFF ) if (nSizeTIFF && checkSeek(rStrm, nOrigPos + nPosTIFF) && rStrm.remainingSize() >= nSizeTIFF)
{ {
std::unique_ptr<sal_uInt8[]> pBuf(new sal_uInt8[ nSizeTIFF ]); std::unique_ptr<sal_uInt8[]> pBuf(new sal_uInt8[ nSizeTIFF ]);
rStrm.Seek( nOrigPos + nPosTIFF );
rStrm.ReadBytes(pBuf.get(), nSizeTIFF); rStrm.ReadBytes(pBuf.get(), nSizeTIFF);
aReplacement.WriteBytes(pBuf.get(), nSizeTIFF); aReplacement.WriteBytes(pBuf.get(), nSizeTIFF);
} }
@@ -519,15 +526,6 @@ void MakePreview(sal_uInt8* pBuf, sal_uInt32 nBytesRead,
rGraphic = aMtf; rGraphic = aMtf;
} }
namespace
{
bool checkSeek(SvStream &rSt, sal_uInt32 nOffset)
{
const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize());
return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset);
}
}
//================== GraphicImport - the exported function ================ //================== GraphicImport - the exported function ================