This is an automated email from the ASF dual-hosted git repository. leginee pushed a commit to branch bazel-migration in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit da74e354462e92f6c7423ce362b774bc4575ec33 Author: Jim Jagielski <[email protected]> AuthorDate: Mon Jun 8 05:10:09 2026 -0400 Fix crash, uninitialized-return, and buffer bugs in update check and macOS x86 bridge updateprotocol.cxx: guard XNodeList dereferences so a swallowed XPathException no longer leaves a null reference to be dereferenced (crash on malformed/hostile update descriptors); clear the list before the relnote query so a thrown exception can't leave us iterating the previous (sources) node list. cpp2uno.cxx: the queryInterface fast-path guard used 'break', which exited the switch and skipped the default case, returning an uninitialized typelib_TypeClass. Guard the block with 'if (bHasHiddenReturn)' instead so control falls through to default and eRet is always assigned. updatecheck.cxx (getImageFromFileName): use bitwise '|' instead of logical '||' when combining osl_Process flags; rewrite the trailing CR/LF trim so it never reads/writes before the start of the buffer (e.g. when osl_readFile returns 0 bytes). Co-Authored-By: Claude Opus 4.8 <[email protected]> (cherry picked from commit 9d1a529d5e69cdb76097a23891d8b0f9baa85789) Backport note: the macOS-only s5abi_macosx_x86-64/cpp2uno.cxx hunk was dropped (it depends on upstream 11db77d7e7, the macOS x86 bridge rework, which this tree does not carry). Only the Windows-relevant extensions/update fixes are taken here. --- main/extensions/source/update/check/updatecheck.cxx | 14 +++++++------- main/extensions/source/update/check/updateprotocol.cxx | 8 ++++++-- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/main/extensions/source/update/check/updatecheck.cxx b/main/extensions/source/update/check/updatecheck.cxx index 0d6f829b63..c3cb19acdf 100644 --- a/main/extensions/source/update/check/updatecheck.cxx +++ b/main/extensions/source/update/check/updatecheck.cxx @@ -157,7 +157,7 @@ rtl::OUString getImageFromFileName(const rtl::OUString& aFile) oslProcessError rc = osl_executeProcess_WithRedirectedIO( aUnpackPath.pData, // [in] Image name &aSystemPath.pData, 1, // [in] Arguments - osl_Process_WAIT || osl_Process_NORMAL, // [in] Options + osl_Process_WAIT | osl_Process_NORMAL, // [in] Options NULL, // [in] Security NULL, // [in] Working directory NULL, 0, // [in] Environment variables @@ -181,14 +181,14 @@ rtl::OUString getImageFromFileName(const rtl::OUString& aFile) rtl::OUString aImageName; while( osl_File_E_None == osl_readFile(hOut, szBuffer, nBytesToRead, &nBytesRead) ) { + // strip trailing CR/LF, but never read/write before the + // start of the buffer (e.g. when nBytesRead == 0) sal_Char *pc = szBuffer + nBytesRead; - do - { - *pc = '\0'; --pc; - } - while( ('\n' == *pc) || ('\r' == *pc) ); + while( pc > szBuffer && ( '\n' == *(pc-1) || '\r' == *(pc-1) ) ) + --pc; + *pc = '\0'; - aImageName += rtl::OUString(szBuffer, pc - szBuffer + 1, osl_getThreadTextEncoding()); + aImageName += rtl::OUString(szBuffer, pc - szBuffer, osl_getThreadTextEncoding()); if( nBytesRead < nBytesToRead ) break; diff --git a/main/extensions/source/update/check/updateprotocol.cxx b/main/extensions/source/update/check/updateprotocol.cxx index c78210d749..eeaeaee73e 100644 --- a/main/extensions/source/update/check/updateprotocol.cxx +++ b/main/extensions/source/update/check/updateprotocol.cxx @@ -163,7 +163,8 @@ checkForUpdates( UNISTRING("http://openoffice.bouncer.osuosl.org/?product=OpenOffice.org&os=solarissparcwjre&lang=en-US&version=2.2.1";) ) ); */ - sal_Int32 i, imax = xNodeList->getLength(); + // xNodeList may be null if selectNodeList() above threw and was swallowed + sal_Int32 i, imax = xNodeList.is() ? xNodeList->getLength() : 0; for( i = 0; i < imax; ++i ) { uno::Reference< xml::dom::XNode > xNode2( xNodeList->item(i) ); @@ -202,13 +203,16 @@ checkForUpdates( o_rUpdateInfo.Description = aEntry.Description; // Release Notes + // reset, so a swallowed exception below does not leave us + // iterating the previous (sources) node list + xNodeList.clear(); try { xNodeList = xXPath->selectNodeList(xNode, aXPathExpression + UNISTRING("/inst:relnote")); } catch (css::xml::xpath::XPathException &) { // ignore } - imax = xNodeList->getLength(); + imax = xNodeList.is() ? xNodeList->getLength() : 0; for( i = 0; i < imax; ++i ) { uno::Reference< xml::dom::XElement > xRelNote(xNodeList->item(i), uno::UNO_QUERY);
