mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ofz#2668 fix oom

Browse Source 
Change-Id: Ie30b24a0ad6395d59afa2f2c96b48f98a33f18a8
Reviewed-on: https://gerrit.libreoffice.org/40064
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
This commit is contained in:
Caolán McNamara
2017-07-17 13:56:38 +01:00
parent a1467c8a52
commit ecae068bef
6 changed files with 27 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
hwpfilter/source/hbox.cxx
View File

@@ -377,7 +377,6 @@ Picture::Picture()
, cap_pos(0)
, num(0)
, pictype(0)
, follow(nullptr)
, ishyper(false)
{
}

2
hwpfilter/source/hbox.h
View File

@@ -630,7 +630,7 @@ struct Picture: public FBox
/**
* It's for the Drawing object
*/
std::unique_ptr<unsigned char[]> follow; /* When the type of image is drawing, gives additional information. */
std::vector<unsigned char> follow; /* When the type of image is drawing, gives additional information. */
bool ishyper;

2
hwpfilter/source/hwpfile.cxx
View File

@@ -169,7 +169,7 @@ bool HWPFile::Read4b(int &out)
return true;
}
int HWPFile::Read1b(void *ptr, size_t nmemb)
size_t HWPFile::Read1b(void *ptr, size_t nmemb)
{
return hiodev ? hiodev->read1b(ptr, nmemb) : 0;
}

2
hwpfilter/source/hwpfile.h
View File

@@ -138,7 +138,7 @@ class DLLEXPORT HWPFile
/**
* Reads nmemb byte array from HIODev
*/
int Read1b( void *ptr, size_t nmemb );
size_t Read1b(void *ptr, size_t nmemb);
/**
* Reads nmemb short type array from HIODev
*/

24
hwpfilter/source/hwpread.cxx
View File

@@ -431,19 +431,35 @@ bool Picture::Read(HWPFile & hwpf)
if (follow_block_size != 0)
{
follow.reset( new unsigned char[follow_block_size] );
follow.clear();
//read potentially compressed data in blocks as its more
//likely large values are simply broken and we'll run out
//of data before we need to realloc
for (size_t i = 0; i < follow_block_size; i+= SAL_MAX_UINT16)
{
size_t nOldSize = follow.size();
size_t nBlock = std::min<size_t>(SAL_MAX_UINT16, follow_block_size - nOldSize);
follow.resize(nOldSize + nBlock);
size_t nReadBlock = hwpf.Read1b(follow.data() + nOldSize, nBlock);
if (nBlock != nReadBlock)
{
follow.resize(nOldSize + nReadBlock);
break;
}
}
follow_block_size = follow.size();
hwpf.Read1b(follow.get(), follow_block_size);
if (pictype == PICTYPE_DRAW)
{
hmem = new HMemIODev(reinterpret_cast<char *>(follow.get()), follow_block_size);
hmem = new HMemIODev(reinterpret_cast<char *>(follow.data()), follow_block_size);
LoadDrawingObjectBlock(this);
style.cell = picinfo.picdraw.hdo;
delete hmem;
hmem = nullptr;
}
else
else if (follow_block_size >= 4)
{
if ((follow[3] << 24 | follow[2] << 16 | follow[1] << 8 | follow[0]) == 0x269)
{

8
hwpfilter/source/hwpreader.cxx
View File

@@ -3827,16 +3827,16 @@ void HwpReader::makePicture(Picture * hbox)
padd("xlink:type", sXML_CDATA, "simple");
#ifdef _WIN32
if( hbox->follow[4] != 0 )
padd("xlink:href", sXML_CDATA, reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(hbox->follow.get() + 4).c_str())));
padd("xlink:href", sXML_CDATA, reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(hbox->follow.data() + 4).c_str())));
else
padd("xlink:href", sXML_CDATA, reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(hbox->follow.get() + 5).c_str())));
padd("xlink:href", sXML_CDATA, reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(hbox->follow.data() + 5).c_str())));
#else
if( hbox->follow[4] != 0 )
padd("xlink:href", sXML_CDATA,
reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(reinterpret_cast<uchar const *>(urltounix(reinterpret_cast<char *>(hbox->follow.get() + 4)).c_str())).c_str())));
reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(reinterpret_cast<uchar const *>(urltounix(reinterpret_cast<char *>(hbox->follow.data() + 4)).c_str())).c_str())));
else
padd("xlink:href", sXML_CDATA,
reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(reinterpret_cast<uchar const *>(urltounix(reinterpret_cast<char *>(hbox->follow.get() + 5)).c_str())).c_str())));
reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(reinterpret_cast<uchar const *>(urltounix(reinterpret_cast<char *>(hbox->follow.data() + 5)).c_str())).c_str())));
#endif
rstartEl("draw:a", mxList.get());
mxList->clear();