[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - vcl/source

[Caolán McNamara]

 vcl/source/gdi/metaact.cxx      |    2 +-
 vcl/source/gdi/svmconverter.cxx |    9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

New commits:
commit 6ed838bfd59ae4db7822daf60ef12cb023799a75
Author: Caolán McNamara <caol...@redhat.com>
Date:   Wed Jan 25 09:21:25 2017 +0000

    ofz#463 unable to mmap
    
    Reviewed-on: https://gerrit.libreoffice.org/33519
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit f6c465bc8e7583a8321f5c881cb008b980e0e3fa)
    
    Change-Id: I509faeda019f42bbe7cdc5fc249f2ea2076bb702
    Reviewed-on: https://gerrit.libreoffice.org/33521
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: David Tardon <dtar...@redhat.com>

diff --git a/vcl/source/gdi/metaact.cxx b/vcl/source/gdi/metaact.cxx
index 047a207..b8169cd 100644
--- a/vcl/source/gdi/metaact.cxx
+++ b/vcl/source/gdi/metaact.cxx
@@ -1114,7 +1114,7 @@ MetaTextArrayAction::MetaTextArrayAction( const Point& 
rStartPt,
 {
     const sal_Int32 nAryLen = pDXAry ? mnLen : 0;
 
-    if( nAryLen )
+    if (nAryLen > 0)
     {
         mpDXAry = new long[ nAryLen ];
         memcpy( mpDXAry, pDXAry, nAryLen * sizeof(long) );
diff --git a/vcl/source/gdi/svmconverter.cxx b/vcl/source/gdi/svmconverter.cxx
index 616e5e7..d9aae46 100644
--- a/vcl/source/gdi/svmconverter.cxx
+++ b/vcl/source/gdi/svmconverter.cxx
@@ -909,6 +909,15 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, 
GDIMetaFile& rMtf )
                         sal_Int32 nDXAryLen = 0;
                         if (nAryLen > 0)
                         {
+                            const size_t nMinRecordSize = sizeof(sal_Int32);
+                            const size_t nMaxRecords = rIStm.remainingSize() / 
nMinRecordSize;
+                            if (static_cast<sal_uInt32>(nAryLen) > nMaxRecords)
+                            {
+                                SAL_WARN("vcl.gdi", "Parsing error: " << 
nMaxRecords <<
+                                         " max possible entries, but " << 
nAryLen << " claimed, truncating");
+                                nAryLen = nMaxRecords;
+                            }
+
                             sal_Int32 nStrLen( aStr.getLength() );
 
                             nDXAryLen = std::max(nAryLen, nStrLen);

_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits