Bug 170030

This was reported to vendor-sec by chris evans:

Bad news, I'm afraid - I located 10 mins to have a look at the Abiword
(2.2.10) RTF importer code and there look to be multiple additional
buffer overflow vulnerabilities. Here are the ones I found with a
quick scan:

(All in ie_imp_RTF.cpp).

1) ParseLevelText, line 411 - apparent overflow of stack-based buffer
iLevelText.

2) getCharsInsideBrace, line 6967 - apparent overflow of static buffer keyword.

3) HandleLists, line 8221 - overflow. Demo at
http://scary.beasts.org/misc/abi1.rtf

4) HandleLists, line 8224, 8228 - apparent overflows.

5) HandleAbiLists, line 8979 - overflow. Demo at
http://scary.beasts.org/misc/abi2.rtf

6) HandleAbiLists - various lines. Additional similarly coded
overflows to item 5).

7) HandleAbiLists, line 8984 - apparent overflow.

8) HandleAbiLists - various lines. Additional similarly coded
overflows to item 7).