Skip to content

C
core
Kaydet (Commit) ad6d83de authored tarafından Caolán McNamara's avatar Caolán McNamara
Dosyalara gözat
Seçenekler

check for legal field sizes before reading 

Change-Id: I3cdb647e1a057be5bb4b32d119ee5bcbbedf7473
üst 8a7b7b7b
Hide whitespace changes
Inline Side-by-side
Showing with 19 additions and 6 deletions
filter/source/graphicfilter/ios2met/ios2met.cxx
Dosyayı görüntüle @ ad6d83de
...@@ -2660,21 +2660,34 @@ void OS2METReader::ReadOS2MET( SvStream & rStreamOS2MET, GDIMetaFile & rGDIMetaF ...@@ -2660,21 +2660,34 @@ void OS2METReader::ReadOS2MET( SvStream & rStreamOS2MET, GDIMetaFile & rGDIMetaF
pOS2MET->ReadUInt16(nFieldType); pOS2MET->ReadUInt16(nFieldType);
pOS2MET->SeekRel(3); pOS2MET->SeekRel(3);
nPos+=8; nFieldSize-=8;
if (pOS2MET->GetError()) break; if (pOS2MET->GetError())
if (pOS2MET->IsEof()) { break;
if (nFieldType==EndDocumnMagic)
break;
if (pOS2MET->IsEof() || nFieldSize < 8)
{
pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR); pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR);
ErrorCode=8; ErrorCode=8;
break; break;
} }
if (nFieldType==EndDocumnMagic) break; nPos+=8; nFieldSize-=8;
if (nFieldSize > pOS2MET->remainingSize())
{
pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR);
ErrorCode=8;
break;
}
ReadField(nFieldType, nFieldSize); ReadField(nFieldType, nFieldSize);
nPos += nFieldSize;
nPos+=(sal_uLong)nFieldSize; if (pOS2MET->Tell() > nPos)
if (pOS2MET->Tell()>nPos) { {
pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR); pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR);
ErrorCode=9; ErrorCode=9;
break; break;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment