mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ofz+ubsan

Browse Source 
Change-Id: I03f4bae4dd35eea9b5d3996e0655ca9a2ccd6a5f
Reviewed-on: https://gerrit.libreoffice.org/42944
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
This commit is contained in:
Caolán McNamara
2017-09-29 15:26:59 +01:00
parent 150e93dbb4
commit e8879de7bc
2 changed files with 27 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
emfio/source/reader/emfreader.cxx
View File

@@ -22,6 +22,7 @@
#include <basegfx/matrix/b2dhommatrix.hxx> #include <basegfx/matrix/b2dhommatrix.hxx>
#include <vcl/dibtools.hxx> #include <vcl/dibtools.hxx>
#include <o3tl/make_unique.hxx> #include <o3tl/make_unique.hxx>
#include <o3tl/safeint.hxx>
#include <tools/stream.hxx> #include <tools/stream.hxx>
#include <memory> #include <memory>
@@ -1590,8 +1591,10 @@ namespace emfio
} }
std::unique_ptr<long[]> pDXAry, pDYAry; std::unique_ptr<long[]> pDXAry, pDYAry;
sal_Int32 nDxSize = nLen * ((nOptions & ETO_PDY) ? 8 : 4);
if ( offDx && (( nCurPos + offDx + nDxSize ) <= nNextPos ) && nNextPos <= mnEndPos ) sal_Int32 nDxSize;
bool bOverflow = o3tl::checked_multiply<sal_Int32>(nLen, (nOptions & ETO_PDY) ? 8 : 4, nDxSize);
if (!bOverflow && offDx && ((nCurPos + offDx + nDxSize) <= nNextPos ) && nNextPos <= mnEndPos)
{ {
mpInputStream->Seek( nCurPos + offDx ); mpInputStream->Seek( nCurPos + offDx );
pDXAry.reset( new long[aText.getLength()] ); pDXAry.reset( new long[aText.getLength()] );

34
emfio/source/reader/mtftools.cxx
View File

@@ -386,16 +386,24 @@ namespace emfio
break; break;
default : default :
{ {
fX2 -= mnWinOrgX; if (mnPixX == 0 || mnPixY == 0)
fY2 -= mnWinOrgY; {
fX2 /= mnWinExtX; SAL_WARN("vcl.emf", "invalid scaling factor");
fY2 /= mnWinExtY; return Point();
fX2 *= mnDevWidth; }
fY2 *= mnDevHeight; else
fX2 += mnDevOrgX; {
fY2 += mnDevOrgY; // fX2, fY2 now in device units fX2 -= mnWinOrgX;
fX2 *= (double)mnMillX * 100.0 / (double)mnPixX; fY2 -= mnWinOrgY;
fY2 *= (double)mnMillY * 100.0 / (double)mnPixY; fX2 /= mnWinExtX;
fY2 /= mnWinExtY;
fX2 *= mnDevWidth;
fY2 *= mnDevHeight;
fX2 += mnDevOrgX;
fY2 += mnDevOrgY; // fX2, fY2 now in device units
fX2 *= (double)mnMillX * 100.0 / (double)mnPixX;
fY2 *= (double)mnMillY * 100.0 / (double)mnPixY;
}
} }
break; break;
} }
@@ -1421,7 +1429,8 @@ namespace emfio
// #i121382# Map DXArray using WorldTransform // #i121382# Map DXArray using WorldTransform
const Size aSizeX(ImplMap(Size(nSumX, 0))); const Size aSizeX(ImplMap(Size(nSumX, 0)));
const basegfx::B2DVector aVectorX(aSizeX.Width(), aSizeX.Height()); const basegfx::B2DVector aVectorX(aSizeX.Width(), aSizeX.Height());
pDXArry[i] = basegfx::fround(aVectorX.getLength()) * (nSumX >= 0 ? 1 : -1); pDXArry[i] = basegfx::fround(aVectorX.getLength());
pDXArry[i] *= (nSumX >= 0 ? 1 : -1);
if (pDYArry) if (pDYArry)
{ {
@@ -1430,7 +1439,8 @@ namespace emfio
const Size aSizeY(ImplMap(Size(0, nSumY))); const Size aSizeY(ImplMap(Size(0, nSumY)));
const basegfx::B2DVector aVectorY(aSizeY.Width(), aSizeY.Height()); const basegfx::B2DVector aVectorY(aSizeY.Width(), aSizeY.Height());
// Reverse Y // Reverse Y
pDYArry[i] = basegfx::fround(aVectorY.getLength()) * (nSumY >= 0 ? -1 : 1); pDYArry[i] = basegfx::fround(aVectorY.getLength());
pDYArry[i] *= (nSumY >= 0 ? -1 : 1);
} }
} }
} }