mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ofz#2668 fix oom

Browse Source 
Change-Id: Ie30b24a0ad6395d59afa2f2c96b48f98a33f18a8
Reviewed-on: https://gerrit.libreoffice.org/40064
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
This commit is contained in:
Caolán McNamara
2017-07-17 13:56:38 +01:00
parent a1467c8a52
commit ecae068bef
6 changed files with 27 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
hwpfilter/source/hbox.cxx
View File

@@ -377,7 +377,6 @@ Picture::Picture()
, cap_pos(0) , cap_pos(0)
, num(0) , num(0)
, pictype(0) , pictype(0)
, follow(nullptr)
, ishyper(false) , ishyper(false)
{ {
} }

2
hwpfilter/source/hbox.h
View File

@@ -630,7 +630,7 @@ struct Picture: public FBox
/** /**
* It's for the Drawing object * It's for the Drawing object
*/ */
std::unique_ptr<unsigned char[]> follow; /* When the type of image is drawing, gives additional information. */ std::vector<unsigned char> follow; /* When the type of image is drawing, gives additional information. */
bool ishyper; bool ishyper;

2
hwpfilter/source/hwpfile.cxx
View File

@@ -169,7 +169,7 @@ bool HWPFile::Read4b(int &out)
return true; return true;
} }
int HWPFile::Read1b(void *ptr, size_t nmemb) size_t HWPFile::Read1b(void *ptr, size_t nmemb)
{ {
return hiodev ? hiodev->read1b(ptr, nmemb) : 0; return hiodev ? hiodev->read1b(ptr, nmemb) : 0;
} }

2
hwpfilter/source/hwpfile.h
View File

@@ -138,7 +138,7 @@ class DLLEXPORT HWPFile
/** /**
* Reads nmemb byte array from HIODev * Reads nmemb byte array from HIODev
*/ */
int Read1b( void *ptr, size_t nmemb ); size_t Read1b(void *ptr, size_t nmemb);
/** /**
* Reads nmemb short type array from HIODev * Reads nmemb short type array from HIODev
*/ */

24
hwpfilter/source/hwpread.cxx
View File

@@ -431,19 +431,35 @@ bool Picture::Read(HWPFile & hwpf)
if (follow_block_size != 0) if (follow_block_size != 0)
{ {
follow.reset( new unsigned char[follow_block_size] ); follow.clear();
//read potentially compressed data in blocks as its more
//likely large values are simply broken and we'll run out
//of data before we need to realloc
for (size_t i = 0; i < follow_block_size; i+= SAL_MAX_UINT16)
{
size_t nOldSize = follow.size();
size_t nBlock = std::min<size_t>(SAL_MAX_UINT16, follow_block_size - nOldSize);
follow.resize(nOldSize + nBlock);
size_t nReadBlock = hwpf.Read1b(follow.data() + nOldSize, nBlock);
if (nBlock != nReadBlock)
{
follow.resize(nOldSize + nReadBlock);
break;
}
}
follow_block_size = follow.size();
hwpf.Read1b(follow.get(), follow_block_size);
if (pictype == PICTYPE_DRAW) if (pictype == PICTYPE_DRAW)
{ {
hmem = new HMemIODev(reinterpret_cast<char *>(follow.get()), follow_block_size); hmem = new HMemIODev(reinterpret_cast<char *>(follow.data()), follow_block_size);
LoadDrawingObjectBlock(this); LoadDrawingObjectBlock(this);
style.cell = picinfo.picdraw.hdo; style.cell = picinfo.picdraw.hdo;
delete hmem; delete hmem;
hmem = nullptr; hmem = nullptr;
} }
else else if (follow_block_size >= 4)
{ {
if ((follow[3] << 24 | follow[2] << 16 | follow[1] << 8 | follow[0]) == 0x269) if ((follow[3] << 24 | follow[2] << 16 | follow[1] << 8 | follow[0]) == 0x269)
{ {

8
hwpfilter/source/hwpreader.cxx
View File

@@ -3827,16 +3827,16 @@ void HwpReader::makePicture(Picture * hbox)
padd("xlink:type", sXML_CDATA, "simple"); padd("xlink:type", sXML_CDATA, "simple");
#ifdef _WIN32 #ifdef _WIN32
if( hbox->follow[4] != 0 ) if( hbox->follow[4] != 0 )
padd("xlink:href", sXML_CDATA, reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(hbox->follow.get() + 4).c_str()))); padd("xlink:href", sXML_CDATA, reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(hbox->follow.data() + 4).c_str())));
else else
padd("xlink:href", sXML_CDATA, reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(hbox->follow.get() + 5).c_str()))); padd("xlink:href", sXML_CDATA, reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(hbox->follow.data() + 5).c_str())));
#else #else
if( hbox->follow[4] != 0 ) if( hbox->follow[4] != 0 )
padd("xlink:href", sXML_CDATA, padd("xlink:href", sXML_CDATA,
reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(reinterpret_cast<uchar const *>(urltounix(reinterpret_cast<char *>(hbox->follow.get() + 4)).c_str())).c_str()))); reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(reinterpret_cast<uchar const *>(urltounix(reinterpret_cast<char *>(hbox->follow.data() + 4)).c_str())).c_str())));
else else
padd("xlink:href", sXML_CDATA, padd("xlink:href", sXML_CDATA,
reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(reinterpret_cast<uchar const *>(urltounix(reinterpret_cast<char *>(hbox->follow.get() + 5)).c_str())).c_str()))); reinterpret_cast<sal_Unicode const *>(hconv(kstr2hstr(reinterpret_cast<uchar const *>(urltounix(reinterpret_cast<char *>(hbox->follow.data() + 5)).c_str())).c_str())));
#endif #endif
rstartEl("draw:a", mxList.get()); rstartEl("draw:a", mxList.get());
mxList->clear(); mxList->clear();