Attachment 296568 Details for Bug 435675 – Upstream patch

[patch] Upstream patch

ooo-CVE-2007-5746.patch (text/plain), 4.63 KB, created by Tomas Hoger on 2008-03-03 10:07:41 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2008-03-03 10:07:41 UTC

Size: 4.63 KB

patch

obsolete

>Index: source/filter.vcl/wmf/enhwmf.cxx
>===================================================================
>RCS file: /cvs/util/svtools/source/filter.vcl/wmf/enhwmf.cxx,v
>retrieving revision 1.35
>retrieving revision 1.35.100.1
>diff -u -r1.35 -r1.35.100.1
>--- openoffice.org.orig/svtools/source/filter.vcl/wmf/enhwmf.cxx	3 Aug 2007 11:50:55 -0000	1.35
>+++ openoffice.org/svtools/source/filter.vcl/wmf/enhwmf.cxx	22 Nov 2007 15:36:50 -0000	1.35.100.1
>@@ -834,11 +834,12 @@
> 				cxDest = abs( (int)cxDest );		// sj: i37894, size can be negative
> 				cyDest = abs( (int)cyDest );		// and also 122889
> 
>-				if ( offBmiSrc )
>+				if ( (cbBitsSrc > (SAL_MAX_UINT32 - 14)) || ((SAL_MAX_UINT32 - 14) - cbBitsSrc < cbBmiSrc) )
>+			        bStatus = FALSE;
>+				else
> 				{
>-					UINT32	nSize = cbBmiSrc + cbBitsSrc + 14;
>-					char*	pBuf = new char[ nSize ];
>-
>+					UINT32 nSize = cbBmiSrc + cbBitsSrc + 14;
>+					char* pBuf = new char[ nSize ];
> 					SvMemoryStream aTmp( pBuf, nSize, STREAM_READ | STREAM_WRITE );
> 					aTmp.ObjectOwnsMemory( TRUE );
> 					aTmp << (BYTE)'B'
>@@ -854,17 +855,17 @@
> 					aTmp.Seek( 0 );
> 					aBitmap.Read( aTmp, TRUE );
> 
>-                    // test if it is sensible to crop
>-                    if ( ( cxSrc > 0 ) && ( cySrc > 0 ) && 
>-                        ( xSrc >= 0 ) && ( ySrc >= 0 ) &&
>-                            ( xSrc + cxSrc <= aBitmap.GetSizePixel().Width() ) &&
>-                                ( ySrc + cySrc <= aBitmap.GetSizePixel().Height() ) )
>-                    {
>-                        Rectangle aCropRect( Point( xSrc, ySrc ), Size( cxSrc, cySrc ) );
>-                        aBitmap.Crop( aCropRect );
>-                    }
>+					// test if it is sensible to crop
>+					if ( ( cxSrc > 0 ) && ( cySrc > 0 ) && 
>+						( xSrc >= 0 ) && ( ySrc >= 0 ) &&
>+							( xSrc + cxSrc <= aBitmap.GetSizePixel().Width() ) &&
>+								( ySrc + cySrc <= aBitmap.GetSizePixel().Height() ) )
>+					{
>+						Rectangle aCropRect( Point( xSrc, ySrc ), Size( cxSrc, cySrc ) );
>+						aBitmap.Crop( aCropRect );
>+					}
>+ 					aBmpSaveList.Insert( new BSaveStruct( aBitmap, aRect, dwRop ), LIST_APPEND );
> 				}
>-				aBmpSaveList.Insert( new BSaveStruct( aBitmap, aRect, dwRop ), LIST_APPEND );
> 			}
> 			break;
> 
>@@ -884,34 +885,38 @@
> 				cxDest = abs( (int)cxDest );		// sj: i37894, size can be negative
> 				cyDest = abs( (int)cyDest );		// and also 122889
> 
>-				UINT32 nSize = cbBmiSrc + cbBitsSrc + 14;
>-				char* pBuf = new char[ nSize ];
>-				SvMemoryStream aTmp( pBuf, nSize, STREAM_READ | STREAM_WRITE );
>-				aTmp.ObjectOwnsMemory( TRUE );
>-				aTmp << (BYTE)'B'
>-					 << (BYTE)'M'
>-					 << (UINT32)cbBitsSrc
>-					 << (UINT16)0
>-					 << (UINT16)0
>-					 << (UINT32)cbBmiSrc + 14;
>-				pWMF->Seek( nStart + offBmiSrc );
>-				pWMF->Read( pBuf + 14, cbBmiSrc );
>-				pWMF->Seek( nStart + offBitsSrc );
>-				pWMF->Read( pBuf + 14 + cbBmiSrc, cbBitsSrc );
>-				aTmp.Seek( 0 );
>-				aBitmap.Read( aTmp, TRUE );
>-
>-                // test if it is sensible to crop
>-                if ( ( cxSrc > 0 ) && ( cySrc > 0 ) && 
>-                    ( xSrc >= 0 ) && ( ySrc >= 0 ) &&
>-                        ( xSrc + cxSrc <= aBitmap.GetSizePixel().Width() ) &&
>-                            ( ySrc + cySrc <= aBitmap.GetSizePixel().Height() ) )
>-                {
>-                    Rectangle aCropRect( Point( xSrc, ySrc ), Size( cxSrc, cySrc ) );
>-                    aBitmap.Crop( aCropRect );
>-                }
>+				if ( (cbBitsSrc > (SAL_MAX_UINT32 - 14)) || ((SAL_MAX_UINT32 - 14) - cbBitsSrc < cbBmiSrc) )
>+			        bStatus = FALSE;
>+				else
>+				{
>+					UINT32 nSize = cbBmiSrc + cbBitsSrc + 14;
>+					char* pBuf = new char[ nSize ];
>+					SvMemoryStream aTmp( pBuf, nSize, STREAM_READ | STREAM_WRITE );
>+					aTmp.ObjectOwnsMemory( TRUE );
>+					aTmp << (BYTE)'B'
>+						<< (BYTE)'M'
>+						<< (UINT32)cbBitsSrc
>+						<< (UINT16)0
>+						<< (UINT16)0
>+						<< (UINT32)cbBmiSrc + 14;
>+					pWMF->Seek( nStart + offBmiSrc );
>+					pWMF->Read( pBuf + 14, cbBmiSrc );
>+					pWMF->Seek( nStart + offBitsSrc );
>+					pWMF->Read( pBuf + 14 + cbBmiSrc, cbBitsSrc );
>+					aTmp.Seek( 0 );
>+					aBitmap.Read( aTmp, TRUE );
> 
>-				aBmpSaveList.Insert( new BSaveStruct( aBitmap, aRect, dwRop ), LIST_APPEND );
>+					// test if it is sensible to crop
>+					if ( ( cxSrc > 0 ) && ( cySrc > 0 ) && 
>+						( xSrc >= 0 ) && ( ySrc >= 0 ) &&
>+							( xSrc + cxSrc <= aBitmap.GetSizePixel().Width() ) &&
>+								( ySrc + cySrc <= aBitmap.GetSizePixel().Height() ) )
>+					{
>+						Rectangle aCropRect( Point( xSrc, ySrc ), Size( cxSrc, cySrc ) );
>+						aBitmap.Crop( aCropRect );
>+					}
>+					aBmpSaveList.Insert( new BSaveStruct( aBitmap, aRect, dwRop ), LIST_APPEND );
>+				}
> 			}
> 			break;
>

Actions: View | Diff

Attachments on bug 435675: 296568