Attachment 585209 Details for Bug 822207 – backport to RHEL-5

[patch] backport to RHEL-5

CVE-2012-2149.patch (text/plain), 3.96 KB, created by Caolan McNamara on 2012-05-17 12:50:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Caolan McNamara

Created: 2012-05-17 12:50:17 UTC

Size: 3.96 KB

patch

obsolete

>diff -ru libwpd-0.8.7/src/lib/WP5ContentListener.cpp libwpd-0.8.7/src/lib/WP5ContentListener.cpp
>--- libwpd-0.8.7/src/lib/WP5ContentListener.cpp	2012-05-17 14:37:43.000000000 +0200
>+++ libwpd-0.8.7/src/lib/WP5ContentListener.cpp	2012-05-17 14:38:54.000000000 +0200
>@@ -196,6 +196,8 @@
> 		_openTableCell(colSpan, rowSpan, borderBits, cellFgColor, cellBgColor,
> 					cellBorderColor, cellVerticalAlignment);
> 		m_ps->m_isCellWithoutParagraph = true;
>+		if (m_ps->m_currentTableCol < 1)
>+			return;
> 		if (useCellAttributes)
> 			m_ps->m_cellAttributeBits = cellAttributes;
> 		else
>diff -ru libwpd-0.8.7/src/lib/WP5StylesListener.cpp libwpd-0.8.7/src/lib/WP5StylesListener.cpp
>--- libwpd-0.8.7/src/lib/WP5StylesListener.cpp	2012-05-17 14:37:43.000000000 +0200
>+++ libwpd-0.8.7/src/lib/WP5StylesListener.cpp	2012-05-17 14:38:54.000000000 +0200
>@@ -256,7 +256,8 @@
> 	if (!isUndoOn()) 
> 	{
> 		m_currentPageHasContent = true;
>-		m_currentTable->insertRow();
>+		if (m_currentTable)
>+			m_currentTable->insertRow();
> 	}
> }
> 
>@@ -268,7 +269,8 @@
> 	if (!isUndoOn())
> 	{
> 		m_currentPageHasContent = true;
>-		m_currentTable->insertCell(colSpan, rowSpan, borderBits);
>+		if (m_currentTable)
>+			m_currentTable->insertCell(colSpan, rowSpan, borderBits);
> 	}
> }
> 
>diff -ru libwpd-0.8.7/src/lib/WP6ContentListener.cpp libwpd-0.8.7/src/lib/WP6ContentListener.cpp
>--- libwpd-0.8.7/src/lib/WP6ContentListener.cpp	2012-05-17 14:37:43.000000000 +0200
>+++ libwpd-0.8.7/src/lib/WP6ContentListener.cpp	2012-05-17 14:38:54.000000000 +0200
>@@ -1059,7 +1059,8 @@
> 
> 		// pull a table definition off of our stack
> 		m_parseState->m_currentTable = m_parseState->m_tableList[m_parseState->m_nextTableIndice++];
>-		m_parseState->m_currentTable->makeBordersConsistent();
>+		if (m_parseState->m_currentTable)
>+			m_parseState->m_currentTable->makeBordersConsistent();
> 		m_ps->m_numRowsToSkip.clear();
> 	}
> }
>diff -ru libwpd-0.8.7/src/lib/WPXContentListener.cpp libwpd-0.8.7/src/lib/WPXContentListener.cpp
>--- libwpd-0.8.7/src/lib/WPXContentListener.cpp	2012-05-17 14:37:43.000000000 +0200
>+++ libwpd-0.8.7/src/lib/WPXContentListener.cpp	2012-05-17 14:38:54.000000000 +0200
>@@ -803,7 +803,8 @@
> {
> 	if (m_ps->m_isTableRowOpened)
> 	{
>-		while ((long)m_ps->m_currentTableCol < (long)m_ps->m_numRowsToSkip.size())
>+		while ((m_ps->m_currentTableCol >= 0) &&
>+			(unsigned long)m_ps->m_currentTableCol < (unsigned long)m_ps->m_numRowsToSkip.size())
> 		{
> 			if (!m_ps->m_numRowsToSkip[m_ps->m_currentTableCol]) // This case should not happen, but does :-(
> 			{
>@@ -862,7 +863,9 @@
> 	if (m_ps->m_isTableCellOpened)
> 		_closeTableCell();
> 
>-	while ((long)m_ps->m_currentTableCol < (long)m_ps->m_numRowsToSkip.size() && m_ps->m_numRowsToSkip[m_ps->m_currentTableCol])
>+	while ((m_ps->m_currentTableCol >= 0) &&
>+		(unsigned long)m_ps->m_currentTableCol < (unsigned long)m_ps->m_numRowsToSkip.size() &&
>+		m_ps->m_numRowsToSkip[m_ps->m_currentTableCol])
> 	{
> 		m_ps->m_numRowsToSkip[m_ps->m_currentTableCol]--;
> 		m_ps->m_currentTableCol++;
>@@ -902,7 +905,9 @@
> 	m_ps->m_isTableCellOpened = true;
> 	m_ps->m_isCellWithoutParagraph = true;
> 
>-	while (((long)m_ps->m_currentTableCol < (long)m_ps->m_numRowsToSkip.size()) && (tmpColSpan > 0))
>+	while ((m_ps->m_currentTableCol >= 0) &&
>+		((unsigned long)m_ps->m_currentTableCol < (unsigned long)m_ps->m_numRowsToSkip.size()) &&
>+		(tmpColSpan > 0))
> 	{
> 		if (m_ps->m_numRowsToSkip[m_ps->m_currentTableCol]) // This case should not happen, but it happens in real-life documents :-(
> 		{
>diff -ru libwpd-0.8.7/src/lib/WPXTable.cpp libwpd-0.8.7/src/lib/WPXTable.cpp
>--- libwpd-0.8.7/src/lib/WPXTable.cpp	2012-05-17 14:37:43.000000000 +0200
>+++ libwpd-0.8.7/src/lib/WPXTable.cpp	2012-05-17 14:38:54.000000000 +0200
>@@ -27,9 +27,6 @@
> #include "WPXTable.h"
> #include "libwpd_internal.h"
> 
>-typedef std::vector<WPXTableCell *>::iterator VTCIter;
>-typedef std::vector< std::vector<WPXTableCell *> * >::iterator VVTCIter;
>-
> _WPXTableCell::_WPXTableCell(uint8_t colSpan, uint8_t rowSpan, uint8_t borderBits) :
> 	m_colSpan(colSpan),
> 	m_rowSpan(rowSpan),

Actions: View | Diff

Attachments on bug 822207: 585209