Attachment 317041 Details for Bug 462639 – better patch format

[patch] better patch format

workspace.sjfixes06.patch (text/plain), 1.98 KB, created by Caolan McNamara on 2008-09-18 07:30:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Caolan McNamara

Created: 2008-09-18 07:30:52 UTC

Size: 1.98 KB

patch

obsolete

>Index: util/svtools/source/filter.vcl/wmf/winwmf.cxx
>diff -u util/svtools/source/filter.vcl/wmf/winwmf.cxx:1.36 util/svtools/source/filter.vcl/wmf/winwmf.cxx:1.36.156.1
>--- util/svtools/source/filter.vcl/wmf/winwmf.cxx:1.36	Thu Apr 10 13:59:55 2008
>+++ util/svtools/source/filter.vcl/wmf/winwmf.cxx	Wed Sep 17 03:24:07 2008
>@@ -816,6 +816,16 @@
> 
> 		case W_META_ESCAPE :
> 		{
>+			// nRecSize has been checked previously to be greater than 3
>+			sal_uInt64 nMetaRecSize = static_cast< sal_uInt64 >( nRecSize - 2 ) * 2;
>+			sal_uInt64 nMetaRecEndPos = pWMF->Tell() + nMetaRecSize;
>+
>+			// taking care that nRecSize does not exceed the maximal stream position
>+			if ( nMetaRecEndPos > nEndPos )
>+			{
>+				pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
>+				break;
>+			}
> 			if ( nRecSize >= 12 )	// minimal escape lenght
> 			{
> 				sal_uInt16	nMode, nLen, OO;
>@@ -838,7 +848,13 @@
> 						sal_uInt32 nCheckSum = rtl_crc32( 0, &nEsc, 4 );
> #endif
> 						sal_Int8* pData = NULL;
>-						if ( nEscLen )
>+
>+						if ( ( static_cast< sal_uInt64 >( nEscLen ) + pWMF->Tell() ) > nMetaRecEndPos )
>+						{
>+							pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
>+							break;
>+						}
>+						if ( nEscLen > 0 )
> 						{
> 							pData = new sal_Int8[ nEscLen ];
> 							pWMF->Read( pData, nEscLen );
>@@ -863,12 +879,14 @@
> 													  >> aPt.Y()
> 													  >> nStringLen;
> 
>-										if (nStringLen < STRING_MAXLEN)
>+										if ( ( static_cast< sal_uInt64 >( nStringLen ) * sizeof( sal_Unicode ) ) < ( nEscLen - aMemoryStream.Tell() ) )
> 										{
> 											sal_Unicode* pBuf = aString.AllocBuffer( (xub_StrLen)nStringLen );
> 											for ( i = 0; i < nStringLen; i++ )
> 												aMemoryStream >> pBuf[ i ];
> 											aMemoryStream >> nDXCount;
>+											if ( ( static_cast< sal_uInt64 >( nDXCount ) * sizeof( sal_Int32 ) ) >= ( nEscLen - aMemoryStream.Tell() ) )
>+												nDXCount = 0;
> 											if ( nDXCount )
> 												pDXAry = new sal_Int32[ nDXCount ];
> 											for  ( i = 0; i < nDXCount; i++ )

Actions: View | Diff

Attachments on bug 462639: 317014 | 317041